The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.

This update of memcached fixes a signedness problem which may lead to a buffer too small to hold all data received from the network, this may allow arbitrary remote code execution. (CVE-2009-2415) Additionally an information leak was fixed (CVE-2009-1494, CVE-2009-1255 )

The process_stat function in Memcached prior 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port (CVE-2009-1255, CVE-2009-1494).

The updated packages have been patched to prevent this.

ID	Name	Product	Family	Severity
42022	openSUSE 10 Security Update : memcached (memcached-6397)	Nessus	SuSE Local Security Checks	critical
40546	openSUSE Security Update : memcached (memcached-1165)	Nessus	SuSE Local Security Checks	critical
40545	openSUSE Security Update : memcached (memcached-1165)	Nessus	SuSE Local Security Checks	critical
38683	Mandriva Linux Security Advisory : memcached (MDVSA-2009:105)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-1494

high

Tenable Plugins

critical

critical

critical

medium