CVE-2009-1494

Publication date 30 April 2009

Last updated 24 July 2024

The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
memcached	9.04 jaunty	Ignored
	8.10 intrepid	Ignored
	8.04 LTS hardy	Ignored
	6.06 LTS dapper	Ignored

How can I get the fixes?
What do statuses mean?
Patch details

Notes

jdstrand

should not be a real issue before 1.2.8

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
memcached	Upstream: http://code.google.com/p/memcachedb/source/detail?r=98

References

MITRE
NVD
Launchpad
Debian

Other references

http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e
https://www.cve.org/CVERecord?id=CVE-2009-1494