Summary
The remote host is missing an update to memcached
announced via advisory MDVSA-2009:202.
Solution
To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:202
Insight
A vulnerability has been found and corrected in memcached:
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows (CVE-2009-2415).
This update provides a solution to this vulnerability. Additionally memcached-1.2.x has been upgraded to 1.2.8 for 2009.0/2009.1 and MES 5 that contains a number of upstream fixes, the repcached patch has been upgraded to 2.2 as well.
Affected: 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0
Severity
Classification
-
CVE CVE-2009-2415 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Mandrake Security Advisory MDVSA-2009:113 (cyrus-sasl)
- Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
- Mandrake Security Advisory MDVSA-2009:035 (gstreamer0.10-plugins-good)
- Mandrake Security Advisory MDVSA-2009:050-1 (python-pycrypto)
- Mandrake Security Advisory MDVSA-2009:141 (mozilla-thunderbird)