CVE-2016-9051

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can simply connect to the port to trigger this vulnerability.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/96374	Broken Link Third Party Advisory VDB Entry
http://www.talosintelligence.com/reports/TALOS-2016-0265/	Exploit Patch Technical Description Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:aerospike:database_server:3.10.0.3:*:*:*:*:*:*:*

History

13 Dec 2022, 21:08

Type	Values Removed	Values Added
References	~~(BID) http://www.securityfocus.com/bid/96374 -~~	(BID) http://www.securityfocus.com/bid/96374 - Broken Link, Third Party Advisory, VDB Entry

Information

Published : 2017-02-21 22:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-9051

Mitre link : CVE-2016-9051

CVE.ORG link : CVE-2016-9051

JSON object : View

Products Affected

aerospike

database_server

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2016-9051", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-02-21T22:59:00.197", "references": [{"url": "http://www.securityfocus.com/bid/96374", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "talos-cna@cisco.com"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2016-0265/", "tags": ["Exploit", "Patch", "Technical Description", "Third Party Advisory", "VDB Entry"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can simply connect to the port to trigger this vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad explotable de escritura fuera de l\u00edmites en la funcionalidad de an\u00e1lisis de campo de transacci\u00f3n por lotes de Aerospike Database Server 3.10.0.3. Un paquete especialmente manipulado puede provocar una escritura fuera de l\u00edmites resultando en corrupci\u00f3n de memoria que puede conducir a la ejecuci\u00f3n remota de c\u00f3digo. Un atacante puede conectarse simplemente al puerto para desencadenar esta vulnerabilidad."}], "lastModified": "2022-12-13T21:08:57.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aerospike:database_server:3.10.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "665632F2-A06C-4767-9607-44706CD1EB98"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}