CVE-2013-7290: Buffer Overflow
The doitemget function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
memcachedto a version that resolves this vulnerability.Fixed in 1.4.17 - Compensating control
If possible, avoid running memcached in verbose mode until the instance is upgraded, to reduce exposure to the remote DoS condition described for do_item_get in items.c when verbose mode is enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7290?
CVE-2013-7290 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2013-7290?
To mitigate CVE-2013-7290, upgrade to Memcached version 1.4.17 or later.
What type of attack is possible with CVE-2013-7290?
CVE-2013-7290 allows remote attackers to trigger segmentation faults, resulting in a denial of service.
Which versions of Memcached are affected by CVE-2013-7290?
Memcached versions from 1.4.4 to 1.4.16 are affected by CVE-2013-7290.
Is CVE-2013-7290 exploitable in default configurations of Memcached?
Yes, CVE-2013-7290 can be exploited when Memcached is running in verbose mode.