CVE-2009-1255
published 2009-04-30CVE-2009-1255: The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps…
PriorityP424medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.25%
81.0th percentile
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | memcached | < memcached 1.2.8-1 (bookworm) | memcached 1.2.8-1 (bookworm) |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcachedb | memcached | <= 1.2.0 | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
| memcachedb | memcached | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-29xr-pwpr-24h3: The process_stat function in (1) Memcached before 1
ghsa_unreviewed·2022-05-02
CVE-2009-1255 [MEDIUM] CWE-200 GHSA-29xr-pwpr-24h3: The process_stat function in (1) Memcached before 1
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
OSV
CVE-2009-1255: The process_stat function in (1) Memcached before 1
osv·2009-04-30·CVSS 5.0
CVE-2009-1255 [MEDIUM] CVE-2009-1255: The process_stat function in (1) Memcached before 1
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Red Hat
memcached: multiple vulnerabilities
vendor_redhat·2009-04-28·CVSS 5.0
CVE-2009-1255 [MEDIUM] memcached: multiple vulnerabilities
memcached: multiple vulnerabilities
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Debian
CVE-2009-1255: memcached - The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0...
vendor_debian·2009·CVSS 5.0
CVE-2009-1255 [MEDIUM] CVE-2009-1255: memcached - The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0...
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Scope: local
bookworm: resolved (fixed in 1.2.8-1)
bullseye: resolved (fixed in 1.2.8-1)
forky: resolved (fixed in 1.2.8-1)
sid: resolved (fixed in 1.2.8-1)
trixie: resolved (fixed in 1.2.8-1)
No detection rules found.
No public exploits indexed.
http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.htmlhttp://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98http://code.google.com/p/memcachedb/source/detail?r=98http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.chttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ehttp://osvdb.org/54127http://secunia.com/advisories/34915http://secunia.com/advisories/34932http://secunia.com/advisories/35175http://www.mandriva.com/security/advisories?name=MDVSA-2009:105http://www.positronsecurity.com/advisories/2009-001.htmlhttp://www.securityfocus.com/archive/1/503064/100/0/threadedhttp://www.securityfocus.com/bid/34756http://www.securitytracker.com/id?1022140http://www.vupen.com/english/advisories/2009/1196http://www.vupen.com/english/advisories/2009/1197https://exchange.xforce.ibmcloud.com/vulnerabilities/50221https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.htmlhttp://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98http://code.google.com/p/memcachedb/source/detail?r=98http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.chttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ehttp://osvdb.org/54127http://secunia.com/advisories/34915http://secunia.com/advisories/34932http://secunia.com/advisories/35175http://www.mandriva.com/security/advisories?name=MDVSA-2009:105http://www.positronsecurity.com/advisories/2009-001.htmlhttp://www.securityfocus.com/archive/1/503064/100/0/threadedhttp://www.securityfocus.com/bid/34756http://www.securitytracker.com/id?1022140http://www.vupen.com/english/advisories/2009/1196http://www.vupen.com/english/advisories/2009/1197https://exchange.xforce.ibmcloud.com/vulnerabilities/50221https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html
2009-04-30
Published