CVE-2009-1255: memcachedb memcached
Vulnerability summary
CVE-2009-1255 is a medium (CVSS 5.0) vulnerability in memcachedb memcached. EPSS estimates a 2.25% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 30-04-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.25%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (positronsecurity.com)
Maturity: unknown
Exploit Reference (code.google.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- memcached< 1.2.8-1
Memcachedb1 product
- memcached≤ 1.2.0 | 0.0.1 | 0.0.2 | 0.0.3 | 0.0.4 | 0.1.0 | 0.1.1 | 1.0.0:beta | 1.0.1:beta | 1.0.2:beta | 1.0.3 | 1.0.4 | 1.1.0:beta | 1.2.0:beta | 1.2.1:beta
2 vendors · 2 products
References
20 links- www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.htmlVendor AdvisoryX Refsource FEDORA
- www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.htmlVendor AdvisoryX Refsource FEDORA
- code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cX Refsource CONFIRMExploitPatch
- groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40eX Refsource CONFIRM
Show all 20 references
- code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98X Refsource CONFIRM
- code.google.com/p/memcachedb/source/detail?r=98X Refsource CONFIRM
