FKIE_CVE-2013-0179

Vulnerability from fkie_nvd - Published: 2014-01-13 21:55 - Updated: 2026-06-16 23:48
Severity
Summary
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
References
secalert@redhat.comhttp://secunia.com/advisories/56183Vendor Advisory
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2013/01/14/4
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2013/01/14/6
secalert@redhat.comhttp://www.securityfocus.com/bid/64978
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-2080-1
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=895054
secalert@redhat.comhttps://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096
secalert@redhat.comhttps://code.google.com/p/memcached/issues/detail?id=306Exploit, Patch
secalert@redhat.comhttps://code.google.com/p/memcached/wiki/ReleaseNotes1417
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/56183Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2013/01/14/4
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2013/01/14/6
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/64978
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2080-1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=895054
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/memcached/issues/detail?id=306Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://code.google.com/p/memcached/wiki/ReleaseNotes1417
Impacted products
Vendor Product Version
memcached memcached 1.4.4
memcached memcached 1.4.5
memcached memcached 1.4.6
memcached memcached 1.4.7
memcached memcached 1.4.8
memcached memcached 1.4.9
memcached memcached 1.4.10
memcached memcached 1.4.11
memcached memcached 1.4.12
memcached memcached 1.4.13
memcached memcached 1.4.14
memcached memcached 1.4.15
memcached memcached 1.4.16
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1F4CD0E-CB74-4D72-ABDF-97820DE6A595",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BC45B91-2C50-4D9A-9D8D-026249FB4B4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FE2B6E7-1066-4D7D-9346-F03487EAE77C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC04F90C-2813-44F8-B48D-9EAF6E8B78A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E305092-2CFD-4A94-BCE5-7F9AAEDB74D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "924552C6-BF90-49F1-A562-620196503246",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "92EFE814-FA06-487A-8E5F-CD00457334A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AB6AF32-7B4B-4FEB-BE5D-A260852ED0DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "A93A9113-B3AE-4952-9B98-B296DB7580B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "F60CAEF4-EDD2-474D-99AE-AFBDE73BBBCE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "29C9CE6E-6330-4346-8989-2A7DA7BFD19A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "01E082CD-A502-4CD2-8995-2086217205A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcached:memcached:1.4.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "48A8CBA7-31EE-4013-A0C9-42444500DF62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n process_bin_delete en memcached.c de memcached 1.4.4 y otras versiones anteriores a 1.4.17, cuando se ejecutan en modo verboso, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (fallo de segmentaci\u00f3n) a trav\u00e9s de una petici\u00f3n que elimina una clave, que no tiene en cuenta la falta de un terminador nulo en la clave y desencadena una sobre-lectura de b\u00fafer cuando se imprime hacia stderr."
    }
  ],
  "id": "CVE-2013-0179",
  "lastModified": "2026-06-16T23:48:55.070",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 1.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:H/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.2,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-01-13T21:55:05.183",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/56183"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/64978"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-2080-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://code.google.com/p/memcached/issues/detail?id=306"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/56183"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2013/01/14/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2013/01/14/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/64978"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2080-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895054"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/memcached/issues/attachmentText?id=306\u0026aid=3060004000\u0026name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch\u0026token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://code.google.com/p/memcached/issues/detail?id=306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://code.google.com/p/memcached/wiki/ReleaseNotes1417"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.