CVE-2013-0179: Buffer Overflow
Description of problem:
When run with "-vv", on receipt of a binary-protocol deletion request, memcached prints out the key to be deleted in a way that can lead to a buffer overrun and crash.
Version-Release number of selected component (if applicable):
1.4.4, although this currently affects all later versions.
How reproducible:
Run memcached with "-vv", use memrm to send deletion requests and observe output.
Steps to Reproduce:
1. memcached -p 12345 -vv 2>&1 | grep '^Deleting' 2. memrm --servers localhost:12345 --binary ABCDEF xyz 3. Check the output from memcached.
Actual results:
[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyzDEF
Expected results:
[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyz
Additional info:
I've opened a bug report upstream: https://code.google.com/p/memcached/issues/detail?id=306
Other sources
The processbindelete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0179?
The severity of CVE-2013-0179 is classified as moderate due to the potential for a buffer overrun and crash.
How do I fix CVE-2013-0179?
To fix CVE-2013-0179, upgrade to a patched version of Memcached beyond 1.4.16.
Which versions are affected by CVE-2013-0179?
CVE-2013-0179 affects Memcached versions 1.4.4 through 1.4.16.
What kind of vulnerability is CVE-2013-0179?
CVE-2013-0179 is a buffer overrun vulnerability related to logging binary-protocol deletion requests.
What are the potential consequences of CVE-2013-0179?
The potential consequences of CVE-2013-0179 include a denial of service due to application crashes.