CVE-2016-8339

A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/93283	Third Party Advisory VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0206/	Exploit Third Party Advisory
https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977	Patch Third Party Advisory
https://security.gentoo.org/glsa/201702-16	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redislabs:redis:3.2.0:::::::*
	cpe:2.3:a:redislabs:redis:3.2.1:::::::*
	cpe:2.3:a:redislabs:redis:3.2.2:::::::*
	cpe:2.3:a:redislabs:redis:3.2.3:::::::*

History

No history.

Information

Published : 2016-10-28 14:59

Updated : 2024-02-04 18:53

NVD link : CVE-2016-8339

Mitre link : CVE-2016-8339

CVE.ORG link : CVE-2016-8339

JSON object : View

Products Affected

redislabs

redis

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2016-8339", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2016-10-28T14:59:01.603", "references": [{"url": "http://www.securityfocus.com/bid/93283", "tags": ["Third Party Advisory", "VDB Entry"], "source": "talos-cna@cisco.com"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2016-0206/", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://github.com/antirez/redis/commit/6d9f8e2462fc2c426d48c941edeb78e5df7d2977", "tags": ["Patch", "Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://security.gentoo.org/glsa/201702-16", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en Redis 3.2.x antes de 3.2.4 provoca ejecuci\u00f3n de c\u00f3digo arbitrario cuando un comando manipulado es enviado. Una vulnerabilidad de escritura fuera de l\u00edmites existe en el manejo de la opci\u00f3n client-output-buffer-limit durante el comando CONFIG SET para la estructura de almac\u00e9n de datos Redis. Un comando CONFIG SET manipulado puede llevar a una escritura fuera de l\u00edmites resultando potencialmente en ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2023-01-30T19:50:41.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redislabs:redis:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54063636-8CE2-408B-BF17-6E68977D4028"}, {"criteria": "cpe:2.3:a:redislabs:redis:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F4E0B88-C020-47C0-9420-E508B9D196B2"}, {"criteria": "cpe:2.3:a:redislabs:redis:3.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC52A6CD-A02A-4153-A353-8BA8AD36EDD1"}, {"criteria": "cpe:2.3:a:redislabs:redis:3.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "227C8FB9-639D-46BD-9484-24F40B3339C1"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}