Memcached
CVE-2013-7239
MEDIUM
Severity by source
AV:A/AC:L/Au:N/C:P/I:P/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:A/AC:L/Au:N/C:P/I:P/A:N
Lifecycle Timeline
1DescriptionCVE.org
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
AnalysisAI
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. Affected products include: Memcached. Version information: before 1.4.17.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of
An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multipl
Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple com
PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. R
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of ser
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary pr
In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. Rated hi
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vuln
In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used inste
Observable timing discrepancy in memcached prior to version 1.6.42 enables remote attackers to enumerate valid SASL auth
In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many
memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c. Rated hi
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today