Vulnerabilities > CVE-2015-8080 - Integer Overflow or Wraparound vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Forced Integer Overflow This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201702-16.NASL description The remote host is affected by the vulnerability described in GLSA-201702-16 (Redis: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, able to connect to a Redis instance, could issue malicious commands possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 97259 published 2017-02-21 reporter This script is Copyright (C) 2017 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/97259 title GLSA-201702-16 : Redis: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201702-16. # # The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(97259); script_version("$Revision: 3.1 $"); script_cvs_date("$Date: 2017/02/21 14:37:43 $"); script_cve_id("CVE-2015-4335", "CVE-2015-8080", "CVE-2016-8339"); script_xref(name:"GLSA", value:"201702-16"); script_name(english:"GLSA-201702-16 : Redis: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201702-16 (Redis: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, able to connect to a Redis instance, could issue malicious commands possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201702-16" ); script_set_attribute( attribute:"solution", value: "All Redis 3.0.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/redis-3.0.7' All Redis 3.2.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/redis-3.2.5'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:redis"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2017/02/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/02/21"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2017 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-db/redis", unaffected:make_list("ge 3.2.5", "ge 3.0.7"), vulnerable:make_list("lt 3.2.5"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Redis"); }
NASL family Misc. NASL id REDIS_CVE-2015-8080.NASL description The version of Redis installed on the remote host is affected by a remote denial of service (DoS) and therefore requires a security update. last seen 2020-06-01 modified 2020-06-02 plugin id 109324 published 2018-04-24 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109324 title Pivotal Software Redis 2.8.x < 2.8.24 / 3.x < 3.0.6 DoS code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(109324); script_version("1.3"); script_cvs_date("Date: 2019/11/08"); script_cve_id("CVE-2015-8080"); script_bugtraq_id(77507); script_name(english:"Pivotal Software Redis 2.8.x < 2.8.24 / 3.x < 3.0.6 DoS"); script_summary(english:"Checks version of Pivotal Software Redis."); script_set_attribute(attribute:"synopsis", value: "Redis requires a security update."); script_set_attribute(attribute:"description", value: "The version of Redis installed on the remote host is affected by a remote denial of service (DoS) and therefore requires a security update."); # https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a89bf59b"); # https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e1f5034"); script_set_attribute(attribute:"solution", value: "Update to Redis 2.8.24 / 3.0.6 or higher."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/08"); script_set_attribute(attribute:"patch_publication_date", value:"2015/12/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/24"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:redis"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("redis_detect.nbin"); script_require_ports("Services/redis_server", 6379); exit(0); } include("audit.inc"); include("misc_func.inc"); include("install_func.inc"); include("global_settings.inc"); appname = "Redis Server"; port = get_service(svc:"redis_server", default:6379, exit_on_fail:TRUE); version = get_kb_item_or_exit("redis/" + port + "/Version"); if (version =~ "^3\.") fix = '3.0.6'; else if (version =~ "^2\.8\.") fix = '2.8.24'; else audit(AUDIT_INST_VER_NOT_VULN, appname); vcomp_out = ver_compare(ver:version, fix:fix); if (!isnull(vcomp_out) && vcomp_out < 0) { report = '\n Port : ' + port + '\n Installed version : ' + version + '\n Fixed version : ' + fix + '\n'; security_report_v4(port:port, severity:SECURITY_WARNING, extra:report); } else { audit(AUDIT_INST_VER_NOT_VULN, appname); }
NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-663.NASL description This update for redis fixes the following security issue : - CVE-2015-8080: Fixed an integer overflow resulting in stack-based overflow. (bsc#954199) last seen 2020-06-05 modified 2016-06-01 plugin id 91410 published 2016-06-01 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/91410 title openSUSE Security Update : redis (openSUSE-2016-663) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2016-663. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(91410); script_version("2.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2015-8080"); script_name(english:"openSUSE Security Update : redis (openSUSE-2016-663)"); script_summary(english:"Check for the openSUSE-2016-663 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for redis fixes the following security issue : - CVE-2015-8080: Fixed an integer overflow resulting in stack-based overflow. (bsc#954199)" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954199" ); script_set_attribute( attribute:"solution", value:"Update the affected redis packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1"); script_set_attribute(attribute:"patch_publication_date", value:"2016/05/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/01"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE13\.2|SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2 / 42.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE13.2", reference:"redis-2.8.22-2.9.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"redis-debuginfo-2.8.22-2.9.1") ) flag++; if ( rpm_check(release:"SUSE13.2", reference:"redis-debugsource-2.8.22-2.9.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"redis-3.0.4-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"redis-debuginfo-3.0.4-3.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"redis-debugsource-3.0.4-3.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "redis / redis-debuginfo / redis-debugsource"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3412.NASL description Luca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash). last seen 2020-06-01 modified 2020-06-02 plugin id 87187 published 2015-12-04 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/87187 title Debian DSA-3412-1 : redis - security update code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-3412. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(87187); script_version("2.9"); script_cvs_date("Date: 2018/11/10 11:49:37"); script_cve_id("CVE-2015-8080"); script_xref(name:"DSA", value:"3412"); script_name(english:"Debian DSA-3412-1 : redis - security update"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Luca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash)." ); script_set_attribute( attribute:"see_also", value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804419" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/jessie/redis" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2015/dsa-3412" ); script_set_attribute( attribute:"solution", value: "Upgrade the redis packages. For the stable distribution (jessie), this problem has been fixed in version 2:2.8.17-1+deb8u3." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:redis"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0"); script_set_attribute(attribute:"patch_publication_date", value:"2015/12/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"8.0", prefix:"redis-server", reference:"2:2.8.17-1+deb8u3")) flag++; if (deb_check(release:"8.0", prefix:"redis-tools", reference:"2:2.8.17-1+deb8u3")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
Redhat
advisories |
| ||||||||||||
rpms |
|
References
- http://www.debian.org/security/2015/dsa-3412
- http://www.openwall.com/lists/oss-security/2015/11/06/2
- https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES
- https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES
- https://github.com/antirez/redis/issues/2855
- http://www.openwall.com/lists/oss-security/2015/11/06/4
- http://rhn.redhat.com/errata/RHSA-2016-0097.html
- http://rhn.redhat.com/errata/RHSA-2016-0095.html
- http://rhn.redhat.com/errata/RHSA-2016-0096.html
- http://www.securityfocus.com/bid/77507
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00126.html
- https://security.gentoo.org/glsa/201702-16