APP: Redis Lua Scripting Component getnum Integer Overflow
This signature detects attempts to exploit a known vulnerability in the Redis Lua Scripting component. This vulnerability is due to the vulnerable server incorrectly parsing specific Lua scripts. A successful attack can lead to an Integer overflow and cause denial of service to the running application.
Extended Description
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Affected Products
Opensuse opensuse
References
CVE: CVE-2015-8080
Short Name
APP:REDIS-GETNUM-IO
Severity
Major
Recommended
True
Recommended Action
Drop
Category
APP
Keywords
CVE-2015-8080 Component Integer Lua Overflow Redis Scripting getnum
Release Date
01/07/2016
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3590
Port
TCP/6379
False Positive
Unknown
Vendors
Redislabs
Opensuse
Debian
Redhat
CVSS Score
5.0