CVE-2016-5009

CWE-20 — Improper Input Validation9 documents8 sources
Severity
6.5MEDIUM
EPSS
1.4%
top 19.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Redhat CephRedhat Ceph Storage MONRedhat Ceph Storage OSD+4 more
Timeline
PublishedJul 12
Latest updateMay 17

Description

The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages8 packages

▶Debianceph< 10.2.5-1+3
▶Ubuntuceph< 0.80.11-0ubuntu1.14.04.3
▶NVDredhat/ceph0.94.6

Also affects: Enterprise Linux 7.0

🔴Vulnerability Details

4
GHSA
GHSA-72p6-9489-jc3f: The handle_command function in mon/Monitor↗2022-05-17
▶
OSV
ceph vulnerabilities↗2017-10-11
▶
CVEList
CVE-2016-5009: The handle_command function in mon/Monitor↗2016-07-12
▶
OSV
CVE-2016-5009: The handle_command function in mon/Monitor↗2016-07-12
▶

📋Vendor Advisories

3
Ubuntu
Ceph vulnerabilities↗2017-10-11
▶
Red Hat
crash: mon_command crashes ceph monitors on receiving empty prefix↗2016-06-14
▶
Debian
CVE-2016-5009: ceph - The handle_command function in mon/Monitor.cc in Ceph allows remote authenticate...↗2016
▶

💬Community

1
Bugzilla
CVE-2016-5009 Ceph monitor crash: mon_command crashes ceph monitors on receiving empty prefix↗2016-06-30
▶
CVE-2016-5009 (MEDIUM CVSS 6.5) | The handle_command function in mon/ | cvebase.io