CVE-2016-9051
CriticalSummary
An out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption and potentially lead to remote code execution.
Risk Assessment
This vulnerability poses a serious risk to organizations as an attacker can remotely exploit the flaw, potentially leading to system takeover.
Recommendation
It is recommended to upgrade to the latest version of Aerospike Database Server to mitigate this vulnerability and to monitor network traffic for potential attack attempts.
Other vulnerabilities in Aerospike Database Server 3.10.0.3
See all- CVE-2016-9050High
An out-of-bounds read vulnerability exists in Aerospike Database Server 3.10.0.3 that can be exploited by an attacker to disclose memory within the process. A specially crafted packet can also trigger a denial of service.
- CVE-2016-9053Critical
An out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server to fetch a function table outside the bounds of an array, resulting in remote code execution.
- CVE-2016-9054Critical
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.
- CVE-2016-9052Critical
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.
Original NVD description (English source)
An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can simply connect to the port to trigger this vulnerability.