CVE-2009-1494

Published: Apr 30, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.

Affected (1)

Products: Memcachedb: Memcached

Memcachedb

1 product

Memcached

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Memcachedb Memcached	Version 1.2.8

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98

Source: cve@mitre.org

http://code.google.com/p/memcachedb/source/detail?r=98

Source: cve@mitre.org

Patch

http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c

Source: cve@mitre.org

Patch

http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e

Source: cve@mitre.org

Patch

http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/50444

Source: cve@mitre.org

http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98