CVE-2013-7291

memcached anterior a la versión 1.4.17, cuando se ejecuta en modo verboso, permite a atacantes remotos provocar una denegación de servicio (caída) a través de una petición que desencadena una "unbounded key print" durante el proceso de inicio de sesión, relacionado con el problema que fue "excluído rápidamente de la raíz de la fuente", una vulnerabilidad diferente a CVE-2013-0179 y CVE-2013-7290.

Multiple vulnerabilities has been discovered and corrected in memcached. The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr. memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. Various other issues have also been addressed.