CVE-2016-9050: aerospike database_server Out-of-bounds Read

Vulnerability summary

CVE-2016-9050 is a high (CVSS 8.2) Out-of-bounds Read vulnerability in aerospike database_server. EPSS estimates a 2.89% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-01-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be used to trigger a denial of service. An attacker can simply connect to the port and send the packet to trigger this vulnerability.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.