CVE-2013-7239

EUVD-2013-7018
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 UNKNOWN
ADJACENT_NETWORK
LOW
AV:A/AC:L/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
Affected Products (NVD)
VendorProductVersion
memcachedmemcached
𝑥
≤ 1.4.16
memcachedmemcached
1.4.0
memcachedmemcached
1.4.1
memcachedmemcached
1.4.2
memcachedmemcached
1.4.3
memcachedmemcached
1.4.4
memcachedmemcached
1.4.5
memcachedmemcached
1.4.6
memcachedmemcached
1.4.7
memcachedmemcached
1.4.8
memcachedmemcached
1.4.9
memcachedmemcached
1.4.10
memcachedmemcached
1.4.11
memcachedmemcached
1.4.12
memcachedmemcached
1.4.13
memcachedmemcached
1.4.14
memcachedmemcached
1.4.15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
memcached
bookworm
1.6.18-1
fixed
bullseye
1.6.9+dfsg-1
fixed
sid
1.6.32-2
fixed
squeeze
not-affected
trixie
1.6.32-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
memcached
lucid
ignored
precise
not-affected
quantal
Fixed 1.4.14-0ubuntu1.12.10.1
released
raring
Fixed 1.4.14-0ubuntu1.13.04.1
released
saucy
Fixed 1.4.14-0ubuntu4.1
released
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2013/q4/572
http://secunia.com/advisories/56183
http://www.debian.org/security/2014/dsa-2832
http://www.securityfocus.com/bid/64559
http://www.ubuntu.com/usn/USN-2080-1
https://code.google.com/p/memcached/wiki/ReleaseNotes1417
http://seclists.org/oss-sec/2013/q4/572
http://secunia.com/advisories/56183
http://www.debian.org/security/2014/dsa-2832
http://www.securityfocus.com/bid/64559
http://www.ubuntu.com/usn/USN-2080-1
https://code.google.com/p/memcached/wiki/ReleaseNotes1417