CVE-2016-5009: Input Validation
Ceph monitors crash when an empty or malformed prefix is sent to moncommand by rados.py. Authenticated attacker can crash ceph monitors by sending specially crafted input to moncommand via rados.py.
Other sources
The handlecommand function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5009?
CVE-2016-5009 has been classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2016-5009?
To fix CVE-2016-5009, upgrade to the latest version of Ceph that addresses this vulnerability.
What type of attack does CVE-2016-5009 enable?
CVE-2016-5009 enables a denial of service attack through segmentation faults that crash Ceph monitors.
Which versions of Ceph are affected by CVE-2016-5009?
CVE-2016-5009 specifically affects Ceph versions up to 1.3.
Who can exploit CVE-2016-5009?
Remote authenticated users can exploit CVE-2016-5009 by sending an empty or crafted prefix to the ceph monitor.