Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

  - Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth,     (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow     remote attackers to cause a denial of service (crash) via a large body length value in a packet.
    (CVE-2011-4971)

  - The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the lack of a null terminator in the key and triggers     a buffer over-read when printing to stderr. (CVE-2013-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

memcached was updated to version 1.4.20 to fix five security issues.

These security issues were fixed :

  - DoS when printing out keys to be deleted in verbose mode     (CVE-2013-0179)

  - Remote DoS (crash) via a request that triggers     'unbounded key print' (CVE-2013-7291)

  - Remote DoS (segmentation fault) via a request to delete     a key (CVE-2013-7290)

  - SASL authentication allows wrong credentials to access     memcache (CVE-2013-7239)

  - Remote DoS (CVE-2011-4971)

The remote host is affected by the vulnerability described in GLSA-201406-13 (memcached: Multiple vulnerabilities)

    memcached authentication could be bypassed when using SASL due to a flaw       related to SASL authentication state. Also several heap-based buffer       overflows due to integer conversions when parsing certain length       attributes were discovered.
  Impact :

    A remote attacker could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition or authenticate with invalid SASL credentials,       bypassing memcached authentication completely.
  Workaround :

    There is no known workaround at this time.

This is an update to the latest upstream release. It fixes several security vulnerabilities, possible crashes when the key is printed in verbose mode and crash with specially crafted packet. (CVE-2011-4971, CVE-2013-0179, CVE-2013-7291 CVE-2013-7290)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Bucur discovered that Memcached incorrectly handled certain large body lengths. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service. (CVE-2011-4971)

Jeremy Sowden discovered that Memcached incorrectly handled logging certain details when the -vv option was used. An attacker could use this issue to cause Memcached to crash, resulting in a denial of service. (CVE-2013-0179)

It was discovered that Memcached incorrectly handled SASL authentication. A remote attacker could use this issue to bypass SASL authentication completely. This issue only affected Ubuntu 12.10, Ubuntu 13.04 and Ubuntu 13.10. (CVE-2013-7239).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2011-4971     Stefan Bucur reported that memcached could be caused to     crash by sending a specially crafted packet.

  - CVE-2013-7239     It was reported that SASL authentication could be     bypassed due to a flaw related to the managment of the     SASL authentication state. With a specially crafted     request, a remote attacker may be able to authenticate     with invalid SASL credentials.

A vulnerability was found and corrected in memcached :

Memcached is vulnerable to a denial of service as it can be made to crash when it receives a specially crafted packet over the network (CVE-2011-4971).

The updated packages for Enterprise Server 5 has beed patched to resolve this flaw.

The updated packages for Business Server 1 has been upgraded to the 1.4.15 version and patched to resolve this flaw.

ID	Name	Product	Family	Severity
199949	RHEL 6 : memcached (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
76365	openSUSE Security Update : memcached (openSUSE-SU-2014:0867-1)	Nessus	SuSE Local Security Checks	medium
76064	GLSA-201406-13 : memcached: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72250	Fedora 19 : memcached-1.4.17-1.fc19 (2014-0934)	Nessus	Fedora Local Security Checks	medium
72249	Fedora 20 : memcached-1.4.17-1.fc20 (2014-0926)	Nessus	Fedora Local Security Checks	medium
71938	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : memcached vulnerabilities (USN-2080-1)	Nessus	Ubuntu Local Security Checks	medium
71780	Debian DSA-2832-1 : memcached - several vulnerabilities	Nessus	Debian Local Security Checks	medium
71075	Mandriva Linux Security Advisory : memcached (MDVSA-2013:280)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2011-4971

high

Tenable Plugins

high

medium

critical

medium

medium

medium

medium

medium