vulnwire
8.1high

CVE-2016-8706in critical feedNuclei template

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary pr…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
45.7%
percentile 99%
Public exploits
0
none known · Nuclei check

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Exploit prediction (EPSS)

45.70% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • Nuclei template Memcached Server SASL Authentication - Remote Code Execution · nuclei detection template

CVSS scores

Assigned byVersionScoreVector
CNA3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Memcached Memcached

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

  • security.gentoo.org /glsa/201701-12 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • debian.org /security/2016/dsa-3704 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2819.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/94083 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1037333 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • talosintelligence.com /reports/TALOS-2016-0221/ · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.