CVE-2016-9050
HighSummary
An out-of-bounds read vulnerability exists in Aerospike Database Server 3.10.0.3 that can be exploited by an attacker to disclose memory within the process. A specially crafted packet can also trigger a denial of service.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive data in memory and disrupt the operation of the database server, impacting service availability.
Recommendation
It is recommended to upgrade to the latest version of Aerospike Database Server to mitigate this vulnerability and to monitor network traffic for potential attack attempts.
Other vulnerabilities in Aerospike Database Server 3.10.0.3
See all- CVE-2016-9053Critical
An out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server to fetch a function table outside the bounds of an array, resulting in remote code execution.
- CVE-2016-9051Critical
An out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption and potentially lead to remote code execution.
- CVE-2016-9054Critical
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.
- CVE-2016-9052Critical
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.
Original NVD description (English source)
An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds read resulting in disclosure of memory within the process, the same vulnerability can also be used to trigger a denial of service. An attacker can simply connect to the port and send the packet to trigger this vulnerability.