CVEvulnerability

CVE-2009-1255

5.0 MEDIUM Published 2009-04-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-04-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.

Affected configurations

• memcachedb memcached (<= 1.2.0) • memcachedb memcached 0.0.1 • memcachedb memcached 0.0.2 • memcachedb memcached 0.0.3 • memcachedb memcached 0.0.4 • memcachedb memcached 0.1.0 • memcachedb memcached 0.1.1 • memcachedb memcached 1.0.0 • memcachedb memcached 1.0.1 • memcachedb memcached 1.0.2 • memcachedb memcached 1.0.3 • memcachedb memcached 1.0.4 • memcachedb memcached 1.1.0 • memcachedb memcached 1.2.0 • memcachedb memcached 1.2.1

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References