Vulnerabilities > CVE-2009-1255 - Information Exposure vulnerability in Memcachedb Memcached

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update memcached-1165.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(40545);
  script_version("1.11");
  script_cvs_date("Date: 2019/10/25 13:36:34");

  script_cve_id("CVE-2009-1255", "CVE-2009-1494", "CVE-2009-2415");

  script_name(english:"openSUSE Security Update : memcached (memcached-1165)");
  script_summary(english:"Check for the memcached-1165 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update of memcached fixes a signedness problem which may lead to
a buffer too small to hold all data received from the network, this
may allow arbitrary remote code execution. (CVE-2009-2415)
Additionally an information leak was fixed (CVE-2009-1494,
CVE-2009-1255 )"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=527875"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected memcached package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(189, 200);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:memcached");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2009/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/11");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.0", reference:"memcached-1.2.2-49.2") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "memcached");
}

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(38207);
  script_version("1.10");

  script_cve_id("CVE-2009-1255");
  script_bugtraq_id(34756);
  script_xref(name:"Secunia", value:"34915");
  script_xref(name:"Secunia", value:"34932");

  script_name(english:"Memcached / MemcacheDB ASLR Bypass Weakness");
  script_summary(english:"Sends a 'stats maps' command");
 
  script_set_attribute( attribute:"synopsis",  value:
"The remote object store suffers from a weakness that may make buffer
overflows easier to exploit."  );
  script_set_attribute( attribute:"description",  value:
"The version of memcached / MemcacheDB running on the remote host
reveals information about the stack, heap, and shared library memory
locations it uses.  An unauthenticated remote attacker may be able to
leverage this weakness to defeat any address space layout
randomization (ASLR) protection on the remote host, thereby making
buffer overflows easier to exploit."  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://www.positronsecurity.com/advisories/2009-001.html"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"https://seclists.org/fulldisclosure/2009/Apr/281"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"http://www.nessus.org/u?97546674"
  );
  script_set_attribute(
    attribute:"see_also", 
    value:"http://www.nessus.org/u?24b11223"
  );
  script_set_attribute( attribute:"solution",  value:
"If using memcached, upgrade to version 1.2.8.

If using MemcacheDB, upgrade to revision r98 or later from the code
repository."  );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(200);
 script_set_attribute(attribute:"plugin_publication_date", value: "2009/04/29");
 script_cvs_date("Date: 2018/11/15 20:50:23");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("memcached_detect.nasl");
  script_require_ports("Services/memcached", 11211, 21201);

  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");


ports = add_port_in_list(list:get_kb_list("Services/memcached"), port:11211);
ports = add_port_in_list(list:ports, port:21201);

foreach port (ports)
{
  if (!get_port_state(port)) continue;

  soc = open_sock_tcp(port);
  if (soc)
  {
    req = "stats maps";
    send(socket:soc, data:string(req, "\r\n"));
    res = recv(socket:soc, length:8192);

    # There's a problem if...
    if (
      # we get a response and...
      !isnull(res) && 
      (
        # either there's an error or...
        stridx(res, 'SERVER_ERROR ') == 0 ||
        # we see a map
        egrep(pattern:"^[0-9a-f]+-[0-9a-f]+[ 	][-r][-w][-x]p[ 	]", string:res)
      )
    )
    {
      if (report_verbosity > 0)
      {
        max_lines = 10;
        n = 0;
        output = "";

        foreach line (split(res, keep:TRUE))
        {
          output += line;
          if (n++ > max_lines) break;
        }
        report = string(
          "\n",
          "Here is the output of sending a '", req, "' command to the remote\n",
          "service :\n",
          "\n",
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
          output,
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n"
        );
        if (n < max_index(split(res)))
        {
          report = string(
            report,
            "\n",
            "Note that only the first ", max_lines, " lines of output are reported.\n"
          );
        }
        if (stridx(res, 'SERVER_ERROR ') == 0)
        {
          report = string(
            report,
            "\n",
            "Note that while the server responded with an error, the error itself\n",
            "indicates the weakness in the code is still present.\n"
          );
        }

        security_warning(port:port, extra:report);
      }
      else security_warning(port);
    }

    close(soc);
  }
}