CVE - CVE-2013-0179

CVE-ID
CVE-2013-0179	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:56183 URL:http://secunia.com/advisories/56183 MISC:64978 URL:http://www.securityfocus.com/bid/64978 MISC:USN-2080-1 URL:http://www.ubuntu.com/usn/USN-2080-1 MISC:[oss-security] 20130114 CVE request: memcached DoS when printing out keys to be deleted in verbose mode URL:http://www.openwall.com/lists/oss-security/2013/01/14/4 MISC:[oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode URL:http://www.openwall.com/lists/oss-security/2013/01/14/6 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=895054 URL:https://bugzilla.redhat.com/show_bug.cgi?id=895054 MISC:https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096 URL:https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096 MISC:https://code.google.com/p/memcached/issues/detail?id=306 URL:https://code.google.com/p/memcached/issues/detail?id=306 MISC:https://code.google.com/p/memcached/wiki/ReleaseNotes1417 URL:https://code.google.com/p/memcached/wiki/ReleaseNotes1417
Assigning CNA
Red Hat, Inc.
Date Record Created
20121206	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20121206)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.