The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.

This update of memcached fixes a signedness problem which may lead to a buffer too small to hold all data received from the network, this may allow arbitrary remote code execution. (CVE-2009-2415) Additionally an information leak was fixed (CVE-2009-1494, CVE-2009-1255 )

Secunia reports :

A weakness has been reported in memcached, which can be exploited by malicious people to disclose system information.

The weakness is caused due to the application disclosing the content of /proc/self/maps if a stats maps command is received. This can be exploited to disclose e.g. the addresses of allocated memory regions.

- Wed Apr 29 2009 Paul Lindner <lindner at inuus.com> -     1.2.8-1

    - Upgrade to memcached-1.2.8

    - Addresses CVE-2009-1255

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Apr 29 2009 Paul Lindner <lindner at inuus.com> -     1.2.8-1

    - Upgrade to memcached-1.2.8

    - Addresses CVE-2009-1255

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.2.6-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Tue Jul 29 2008 Paul Lindner <lindner at inuus.com> -       1.2.6-1

    - Upgrade to memcached-1.2.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The process_stat function in Memcached prior 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port (CVE-2009-1255, CVE-2009-1494).

The updated packages have been patched to prevent this.

The version of memcached / MemcacheDB running on the remote host reveals information about the stack, heap, and shared library memory locations it uses.  An unauthenticated remote attacker may be able to leverage this weakness to defeat any address space layout randomization (ASLR) protection on the remote host, thereby making buffer overflows easier to exploit.

ID	Name	Product	Family	Severity
42022	openSUSE 10 Security Update : memcached (memcached-6397)	Nessus	SuSE Local Security Checks	critical
40660	FreeBSD : memcached -- memcached stats maps Information Disclosure Weakness (86ada694-8b30-11de-b9d0-000c6e274733)	Nessus	FreeBSD Local Security Checks	medium
40546	openSUSE Security Update : memcached (memcached-1165)	Nessus	SuSE Local Security Checks	critical
40545	openSUSE Security Update : memcached (memcached-1165)	Nessus	SuSE Local Security Checks	critical
38916	Fedora 11 : memcached-1.2.8-1.fc11 (2009-4542)	Nessus	Fedora Local Security Checks	medium
38835	Fedora 10 : memcached-1.2.8-1.fc10 (2009-4199)	Nessus	Fedora Local Security Checks	medium
38683	Mandriva Linux Security Advisory : memcached (MDVSA-2009:105)	Nessus	Mandriva Local Security Checks	medium
38207	Memcached / MemcacheDB ASLR Bypass Weakness	Nessus	Misc.	medium

Detections

Analytics

CVE-2009-1255

high

Tenable Plugins

critical

medium

critical

critical

medium

medium

medium

medium