CVE-2016-8706
Published: 2 November 2016
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
Priority
CVSS 3 base score: 8.1
Status
| Package | Release | Status |
|---|---|---|
|
memcached Launchpad, Ubuntu, Debian |
upstream |
Released
(1.4.33)
|
| precise |
Released
(1.4.13-0ubuntu2.2)
|
|
| trusty |
Does not exist
(trusty was released [1.4.14-0ubuntu9.1])
|
|
| xenial |
Released
(1.4.25-2ubuntu1.2)
|
|
| yakkety |
Released
(1.4.25-2ubuntu2.1)
|
|
|
Patches: upstream: https://github.com/memcached/memcached/commit/bd578fc34b96abe0f8d99c1409814a09f51ee71c |
||
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8706
- http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html
- http://www.talosintelligence.com/reports/TALOS-2016-0221/
- https://github.com/memcached/memcached/wiki/ReleaseNotes1433
- https://ubuntu.com/security/notices/USN-3120-1
- NVD
- Launchpad
- Debian