PT-2017-2444 · Aerospike · Aerospike Database Server

Published 2017-02-21 · Updated 2022-12-13 · CVE-2016-9051

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aerospike Database Server version 3.10.0.3

Description The issue is related to an out-of-bounds write vulnerability in the batch transaction field parsing functionality. This can be triggered by a specially crafted packet, leading to memory corruption and potentially allowing remote code execution. An attacker can exploit this by simply connecting to the port.

Recommendations For Aerospike Database Server version 3.10.0.3, consider restricting access to the batch transaction field parsing functionality until a patch is available. As a temporary workaround, limit connections to the affected port to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2017-01649

CVE-2016-9051

Affected Products

Aerospike Database Server

References · 5

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0265 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9051 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9051 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01649 · Security Note
• http://securityfocus.com/bid/96374 · Note