CVE-2013-7239

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.8 UNKNOWN
ADJACENT_NETWORK
LOW
AV:A/AC:L/Au:N/C:P/I:P/A:N
debianCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
VendorProductVersion
memcachedmemcached
𝑥
≤ 1.4.16
memcachedmemcached
1.4.0
memcachedmemcached
1.4.1
memcachedmemcached
1.4.2
memcachedmemcached
1.4.3
memcachedmemcached
1.4.4
memcachedmemcached
1.4.5
memcachedmemcached
1.4.6
memcachedmemcached
1.4.7
memcachedmemcached
1.4.8
memcachedmemcached
1.4.9
memcachedmemcached
1.4.10
memcachedmemcached
1.4.11
memcachedmemcached
1.4.12
memcachedmemcached
1.4.13
memcachedmemcached
1.4.14
memcachedmemcached
1.4.15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
memcached
bullseye
1.6.9+dfsg-1
fixed
squeeze
not-affected
bookworm
1.6.18-1
fixed
trixie
1.6.32-1
fixed
sid
1.6.32-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
memcached
saucy
Fixed 1.4.14-0ubuntu4.1
released
raring
Fixed 1.4.14-0ubuntu1.13.04.1
released
quantal
Fixed 1.4.14-0ubuntu1.12.10.1
released
precise
not-affected
lucid
ignored
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2013/q4/572
http://secunia.com/advisories/56183
http://www.debian.org/security/2014/dsa-2832
http://www.securityfocus.com/bid/64559
http://www.ubuntu.com/usn/USN-2080-1
https://code.google.com/p/memcached/wiki/ReleaseNotes1417
http://seclists.org/oss-sec/2013/q4/572
http://secunia.com/advisories/56183
http://www.debian.org/security/2014/dsa-2832
http://www.securityfocus.com/bid/64559
http://www.ubuntu.com/usn/USN-2080-1
https://code.google.com/p/memcached/wiki/ReleaseNotes1417