CVE-2009-1255

memcached: multiple vulnerabilities

Published Apr 30, 2009 CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Description
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2009-1254 The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 5:04 AM
Reserved
Apr 7, 2009, 12:00 AM
Status
Modified
Published
Apr 30, 2009, 8:30 PM
Modified
Jun 16, 2026, 11:06 PM
Severity
Important
Public date
Apr 28, 2009, 12:00 AM