CVE-2009-1494
published 2009-04-30CVE-2009-1494: The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to…
PriorityP420medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.49%
71.2th percentile
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | memcached | < memcached 1.2.8-1 (bookworm) | memcached 1.2.8-1 (bookworm) |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcached | memcached | >= 0 < 1.2.8-1 | 1.2.8-1 |
| memcachedb | memcached | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-57m3-vpr5-77vh: The process_stat function in Memcached 1
ghsa_unreviewed·2022-05-02
CVE-2009-1494 [MEDIUM] CWE-200 GHSA-57m3-vpr5-77vh: The process_stat function in Memcached 1
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
OSV
CVE-2009-1494: The process_stat function in Memcached 1
osv·2009-04-30·CVSS 5.0
CVE-2009-1494 [MEDIUM] CVE-2009-1494: The process_stat function in Memcached 1
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
Red Hat
memcached: multiple vulnerabilities
vendor_redhat·2009-04-28·CVSS 5.0
CVE-2009-1494 [MEDIUM] memcached: multiple vulnerabilities
memcached: multiple vulnerabilities
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
Debian
CVE-2009-1494: memcached - The process_stat function in Memcached 1.2.8 discloses memory-allocation statist...
vendor_debian·2009·CVSS 5.0
CVE-2009-1494 [MEDIUM] CVE-2009-1494: memcached - The process_stat function in Memcached 1.2.8 discloses memory-allocation statist...
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
Scope: local
bookworm: resolved (fixed in 1.2.8-1)
bullseye: resolved (fixed in 1.2.8-1)
forky: resolved (fixed in 1.2.8-1)
sid: resolved (fixed in 1.2.8-1)
trixie: resolved (fixed in 1.2.8-1)
No detection rules found.
No public exploits indexed.
http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98http://code.google.com/p/memcachedb/source/detail?r=98http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.chttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ehttp://memcached.googlecode.com/files/memcached-1.2.8.tar.gzhttps://exchange.xforce.ibmcloud.com/vulnerabilities/50444http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98http://code.google.com/p/memcachedb/source/detail?r=98http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.chttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ehttp://memcached.googlecode.com/files/memcached-1.2.8.tar.gzhttps://exchange.xforce.ibmcloud.com/vulnerabilities/50444
2009-04-30
Published