CVE-2009-2415

NameCVE-2009-2415
DescriptionMultiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1853-1
NVD severityhigh (attack range: remote)
Debian Bugs540379, 540381

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
memcached (PTS)wheezy1.4.13-0.2+deb7u1fixed
wheezy (security)1.4.13-0.2+deb7u3fixed
jessie, jessie (security)1.4.21-1.1+deb8u1fixed
stretch1.4.33-1fixed
buster, sid1.5.1-1fixed
memcachedb (PTS)wheezy1.2.0-9fixed
jessie1.2.0-11fixed
buster, sid, stretch1.2.0-12fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
memcachedsource(unstable)1.4.1-1medium540379
memcachedsourceetch1.1.12-1+etch1highDSA-1853-1
memcachedsourcelenny1.2.2-1+lenny1highDSA-1853-1
memcachedbsource(unstable)1.2.0-5medium540381

Notes

the impact varies, on etch this runs as root and is not bound
to the loopback interface by default, memcached is even distributed
but fortunately not in a stable release.

Search for package or bug name: Reporting problems