CVE-2016-8704: Integer Overflow
An integer overflow in the processbinappendprepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Other sources
An integer overflow in the processbinappendprepend function which is responsible for processing multiple commands of Memcached binary protocol can be abused to cause heap overflow and lead to remote code execution.
External References:
http://www.talosintelligence.com/reports/TALOS-2016-0219/
Upstream patch:
https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8704?
CVE-2016-8704 has a critical severity rating as it can lead to remote code execution due to a potential heap overflow.
How do I fix CVE-2016-8704?
To fix CVE-2016-8704, upgrade Memcached to version 1.4.33 or later.
What systems are affected by CVE-2016-8704?
CVE-2016-8704 affects Memcached versions up to and including 1.4.31.
Can CVE-2016-8704 be exploited remotely?
Yes, CVE-2016-8704 can be exploited remotely, allowing attackers to execute arbitrary code.
Is there a workaround for CVE-2016-8704?
There are no officially documented workarounds for CVE-2016-8704; upgrading to the patched version is recommended.