Detections
Analytics
Memcached / MemcacheDB ASLR Bypass Weakness
medium Nessus Plugin ID 38207
Language:
Synopsis
The remote object store suffers from a weakness that may make buffer overflows easier to exploit.Description
The version of memcached / MemcacheDB running on the remote host reveals information about the stack, heap, and shared library memory locations it uses. An unauthenticated remote attacker may be able to leverage this weakness to defeat any address space layout randomization (ASLR) protection on the remote host, thereby making buffer overflows easier to exploit.Solution
If using memcached, upgrade to version 1.2.8.If using MemcacheDB, upgrade to revision r98 or later from the code repository.
See Also
https://www.positronsecurity.com/advisories/2009-001.html
https://seclists.org/fulldisclosure/2009/Apr/281
Plugin Details
Severity: Medium
ID: 38207
File Name: memcached_aslr_bypass.nasl
Version: 1.10
Type: remote
Family: Misc.
Published: 4/29/2009
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Exploit Ease: No known exploits are available
Reference Information
CVE: CVE-2009-1255
BID: 34756