CVE-2011-4971

Memcached < 1.4.5 - Numeric Error

Title source: rule

Description

Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.

Exploits (1)

metasploit WORKING POC

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/misc/memcached.rb

View Code ZIP pw:eip

References (8)

[Exploit] http://insecurety.net/?p=872

[Third Party Advisory] http://secunia.com/advisories/56183

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2013:280

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2080-1

[Exploit, Patch] https://code.google.com/p/memcached/issues/detail?id=192

[Various Sources] https://puppet.com/security/cve/cve-2011-4971

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/59567

[Third Party Advisory] http://www.debian.org/security/2014/dsa-2832

Scores

EPSS 0.4607

EPSS Percentile 97.6%

Details

CWE

CWE-189

Status published

Products (8)

memcached/memcached 1.2.7

memcached/memcached 1.2.8

memcached/memcached 1.4.0

memcached/memcached 1.4.1

memcached/memcached 1.4.2

memcached/memcached 1.4.3

memcached/memcached 1.4.4

memcached/memcached < 1.4.5

Published Dec 12, 2013

Tracked Since Feb 18, 2026