Vulnerabilities > CVE-2015-8080 - Integer Overflow or Wraparound vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
redislabs
debian
opensuse
redhat
CWE-190
nessus

Summary

Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201702-16.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201702-16 (Redis: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Redis. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, able to connect to a Redis instance, could issue malicious commands possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id97259
    published2017-02-21
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97259
    titleGLSA-201702-16 : Redis: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201702-16.
    #
    # The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97259);
      script_version("$Revision: 3.1 $");
      script_cvs_date("$Date: 2017/02/21 14:37:43 $");
    
      script_cve_id("CVE-2015-4335", "CVE-2015-8080", "CVE-2016-8339");
      script_xref(name:"GLSA", value:"201702-16");
    
      script_name(english:"GLSA-201702-16 : Redis: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201702-16
    (Redis: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in Redis. Please review
          the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker, able to connect to a Redis instance, could issue
          malicious commands possibly resulting in the execution of arbitrary code
          with the privileges of the process or a Denial of Service condition.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201702-16"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Redis 3.0.x users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/redis-3.0.7'
        All Redis 3.2.x users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/redis-3.2.5'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:redis");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/02/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/02/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-db/redis", unaffected:make_list("ge 3.2.5", "ge 3.0.7"), vulnerable:make_list("lt 3.2.5"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Redis");
    }
    
  • NASL familyMisc.
    NASL idREDIS_CVE-2015-8080.NASL
    descriptionThe version of Redis installed on the remote host is affected by a remote denial of service (DoS) and therefore requires a security update.
    last seen2020-06-01
    modified2020-06-02
    plugin id109324
    published2018-04-24
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109324
    titlePivotal Software Redis 2.8.x < 2.8.24 / 3.x < 3.0.6 DoS
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109324);
      script_version("1.3");
      script_cvs_date("Date: 2019/11/08");
    
      script_cve_id("CVE-2015-8080");
      script_bugtraq_id(77507);
    
      script_name(english:"Pivotal Software Redis 2.8.x < 2.8.24 / 3.x < 3.0.6 DoS");
      script_summary(english:"Checks version of Pivotal Software Redis.");
    
      script_set_attribute(attribute:"synopsis", value:
    "Redis requires a security update.");
      script_set_attribute(attribute:"description", value:
    "The version of Redis installed on the remote host is affected by a
    remote denial of service (DoS) and therefore requires a security update.");
      # https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a89bf59b");
      # https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9e1f5034");
      script_set_attribute(attribute:"solution", value:
    "Update to Redis 2.8.24 / 3.0.6 or higher.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/12/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/24");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:redis");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("redis_detect.nbin");
      script_require_ports("Services/redis_server", 6379);
    
      exit(0);
    }
    
    include("audit.inc");
    include("misc_func.inc");
    include("install_func.inc");
    include("global_settings.inc");
    
    appname = "Redis Server";
    port = get_service(svc:"redis_server", default:6379, exit_on_fail:TRUE);
    version = get_kb_item_or_exit("redis/" + port + "/Version");
    
    if (version =~ "^3\.") fix = '3.0.6';
    else if (version =~ "^2\.8\.") fix = '2.8.24';
    else
      audit(AUDIT_INST_VER_NOT_VULN, appname);
    
    vcomp_out = ver_compare(ver:version, fix:fix);
    if (!isnull(vcomp_out) && vcomp_out < 0)
    {
      report =
        '\n  Port              : ' + port +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix +
        '\n';
    
      security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);
    }
    else
    {
      audit(AUDIT_INST_VER_NOT_VULN, appname);
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-663.NASL
    descriptionThis update for redis fixes the following security issue : - CVE-2015-8080: Fixed an integer overflow resulting in stack-based overflow. (bsc#954199)
    last seen2020-06-05
    modified2016-06-01
    plugin id91410
    published2016-06-01
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91410
    titleopenSUSE Security Update : redis (openSUSE-2016-663)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2016-663.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91410);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-8080");
    
      script_name(english:"openSUSE Security Update : redis (openSUSE-2016-663)");
      script_summary(english:"Check for the openSUSE-2016-663 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for redis fixes the following security issue :
    
      - CVE-2015-8080: Fixed an integer overflow resulting in
        stack-based overflow. (bsc#954199)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=954199"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected redis packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:redis-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/05/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2|SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2 / 42.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"redis-2.8.22-2.9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"redis-debuginfo-2.8.22-2.9.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"redis-debugsource-2.8.22-2.9.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"redis-3.0.4-3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"redis-debuginfo-3.0.4-3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.1", reference:"redis-debugsource-3.0.4-3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "redis / redis-debuginfo / redis-debugsource");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3412.NASL
    descriptionLuca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash).
    last seen2020-06-01
    modified2020-06-02
    plugin id87187
    published2015-12-04
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/87187
    titleDebian DSA-3412-1 : redis - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3412. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87187);
      script_version("2.9");
      script_cvs_date("Date: 2018/11/10 11:49:37");
    
      script_cve_id("CVE-2015-8080");
      script_xref(name:"DSA", value:"3412");
    
      script_name(english:"Debian DSA-3412-1 : redis - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Luca Bruno discovered an integer overflow flaw leading to a
    stack-based buffer overflow in redis, a persistent key-value database.
    A remote attacker can use this flaw to cause a denial of service
    (application crash)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804419"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/redis"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2015/dsa-3412"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the redis packages.
    
    For the stable distribution (jessie), this problem has been fixed in
    version 2:2.8.17-1+deb8u3."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:redis");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"redis-server", reference:"2:2.8.17-1+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"redis-tools", reference:"2:2.8.17-1+deb8u3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Redhat

advisories
  • rhsa
    idRHSA-2016:0095
  • rhsa
    idRHSA-2016:0096
  • rhsa
    idRHSA-2016:0097
rpms
  • redis-0:2.8.24-1.el7ost
  • redis-debuginfo-0:2.8.24-1.el7ost
  • redis-0:2.8.24-1.el7ost
  • redis-debuginfo-0:2.8.24-1.el7ost
  • redis-0:2.8.24-1.el7ost
  • redis-debuginfo-0:2.8.24-1.el7ost