Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

  - The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a     denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between     signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2016-8705. (CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification,     CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via     network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack     appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have     been fixed in 1.5.6 due to the disabling of the UDP protocol by default. (CVE-2018-1000115)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

  - Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth,     (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow     remote attackers to cause a denial of service (crash) via a large body length value in a packet.
    (CVE-2011-4971)

  - The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the lack of a null terminator in the key and triggers     a buffer over-read when printing to stderr. (CVE-2013-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1627 advisory.

    Red Hat OpenStack Platform director provides the facilities for deploying     and monitoring a private or public infrastructure-as-a-service (IaaS) cloud     based on Red Hat OpenStack Platform.

    Security Fix(es):

    * A resource-permission flaw was found in the python-tripleo and openstack-tripleo-heat-templates packages     where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key     could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack     service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

    To exploit this flaw, the attacker must have local access to an overcloud node. However by default, access     to overcloud nodes is restricted and accessible only from the management undercloud server on an internal     network. (CVE-2017-12155)

    This issue was discovered by Katuya Kawakami (NEC).

    * It was discovered that the memcached connections using UDP transport protocol can be abused for     efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send     a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to     send a significantly larger response to the target. (CVE-2018-1000115)

    This update also includes the following bug fixes and enhancements:

    * Prior to this update, when removing the ceph-osd RPM from overcloud nodes that do not require the     package, the corresponding Ceph OSD product key was not removed. Consequently, the subscription-manager     would incorrectly report that the Ceph OSD product was still installed.
    With this update, the script that handles removal of the ceph-osd RPM now also removes the Ceph OSD     product key. Note: The script that removes the RPM and product key executes only during the overcloud     update procedure; the product key is removed only when the overcloud node is updated.
    As a result, after removing the ceph-osd RPM, the subscription-manager no longer reports the Ceph OSD     product is installed. (BZ#1571436)

    * Previously, there were errors in the director Heat template that configures the VMAX Cinder backend     driver. Consequently, the VMAX driver would not function correctly. With this update, the errors have been     corrected, and the VMAX driver functions correctly. (BZ#1546799)

    * This enhancement adds director support for deploying the Dell EMC VMAX cinder backend. (BZ#1546793)

    * In this enhancement, if a minor update is blocked by an existing yum process that prevents the package     update, the process should exit with an appropriate error message. This was added because the minor update     may appear to freeze, due to yum waiting for the existing yum.pid to exit; when it eventually fails it is     not immediately clear why. As a result, if there is an existing yum process preventing the package update,     then the minor update fails with a clear message to indicate this: ERROR existing yum.pid detected -     can't continue! Please ensure there is no other package update process for the duration of the minor     update worfklow. Exiting. (BZ#1471721)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1593 advisory.

    Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or     public infrastructure-as-a-service (IaaS) cloud based on Red Hat OpenStack Platform.

    Security Fix(es):

    * A resource-permission flaw was found in the python-tripleo and openstack-tripleo-heat-templates packages     where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key     could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack     service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

    To exploit this flaw, the attacker must have local access to an overcloud node. However by default, access     to overcloud nodes is restricted and accessible only from the management undercloud server on an internal     network. (CVE-2017-12155)

    This issue was discovered by Katuya Kawakami (NEC).

    * It was discovered that the memcached connections using UDP transport protocol can be abused for     efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send     a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to     send a significantly larger response to the target. (CVE-2018-1000115)

    This advisory also addresses the following issues:

    * This release adds support for deploying Dell EMC VMAX Block Storage backend using the Red Hat OpenStack     Platform director. (BZ#1503896)

    * Using composable roles for deploying Dell SC and PS Block Storage backend caused errors. The backends     could only be deploying using 'cinder::config::cinder_config' hiera data.
    With this update, the composable role support for deploying the Dell SC and PS Block Storage backends is     updated. As a result, they can be now deployed using composable roles. (BZ#1552980)

    * Previously, the iptables rules were managed by the Red Hat OpenStack Platform director and the OpenStack     Networking service, which resulted in the rules created by the OpenStack Networking service to persist on     to the disk. As a result, the rules that should not be loaded after an iptables restart or a system reboot     would be loaded causing traffic issues.
    With this update, the Red Hat OpenStack Platform director has been updated to exclude the OpenStack     Networking rules from '/etc/sysconfig/iptables' when the director saves the firewall rules. As a result,     iptables restart or a system reboot should work without causing traffic problems.
    Note: It might be necessary to perform a rolling restart of the controller nodes to ensure that any     orphaned managed neutron rules are no longer reloaded. (BZ#1541528)

    * OS::TripleO::SwiftStorage::Ports* resources have been renamed to OS::TripleO::ObjectStorage::Port* to     ensure standalone Object Storage nodes using the 'ObjectStorage' roles can be deployed correctly.
    Operators need to modify their custom templates that previously used OS::TripleO::SwiftStorage::Ports*     settings. (BZ#1544802)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2331 advisory.

    memcached is a high-performance, distributed memory object caching system, generic in nature, but intended     for use in speeding up dynamic web applications by alleviating database load.

    Security fix(es):

    * memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    For more information about the bug fixes and enhancements included with     this update, see the Technical Notes section of the Release Notes     linked in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2857 advisory.

    memcached is a high-performance, distributed memory object caching system, generic in nature, but intended     for use in speeding up dynamic web applications by alleviating database load.

    instack-undercloud provides a collection of scripts and elements that can be used to install an OpenStack     undercloud (using python-instack).

    openstack-tripleo-heat-templates is a collection of OpenStack Orchestration templates and tools (codename     heat), which can be used to help deploy OpenStack.

    Security Fix(es):

    * memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * This update fixes a race condition that could cause pacemaker-managed glance-fs deployments to fail.

    Now the glance-fs resource is created from a single node of the overcloud in a way that eliminates the     race condition and the resultant deployment failures. (BZ#1418617)

    * Prior to this update, the source IP address for cold migration and resize was determined by the default     gateway configured on the source compute node.

    Now the my_ip option is explicitly set to the internal_api network IP in nova.conf, ensuring the correct     network is used for this traffic. (BZ#1552855)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the memcached packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-9951     Daniel Shapira reported a heap-based buffer over-read in     memcached (resulting from an incomplete fix for     CVE-2016-8705 ) triggered by specially crafted requests     to add/set a key and allowing a remote attacker to cause     a denial of service.

  - CVE-2018-1000115     It was reported that memcached listens to UDP by     default. A remote attacker can take advantage of it to     use the memcached service as a DDoS amplifier.

  Default installations of memcached in Debian are not affected by   this issue as the installation defaults to listen only on localhost.
  This update disables the UDP port by default. Listening on the UDP   can be re-enabled in the /etc/memcached.conf (cf.
  /usr/share/doc/memcached/NEWS.Debian.gz).

  - CVE-2018-1000127     An integer overflow was reported in memcached, resulting     in resource leaks, data corruption, deadlocks or     crashes.

It was discovered that the memcached daemon listened on UDP port 11211 by default. An attacker could use memcached for UDP amplification denial-of-service attacks. The UDP port has been disabled by default, but can still be enabled.

It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to send a significantly larger response to the target. (CVE-2018-1000115)

This update for memcached fixes the following issues :

  - CVE-2018-1000115: Insufficient Control of Network     Message Volume (Network Amplification, CWE-406)     vulnerability in the UDP support of the memcached server     could result in denial of service via network flood     (traffic amplification of 1:50,000 has been reported by     reliable sources). (bsc#1083903)

  - Home directory shouldn't be world readable bsc#1077718

This update was imported from the SUSE:SLE-12:Update update project.

This update for memcached fixes the following issues :

  - CVE-2018-1000115: Insufficient Control of Network     Message Volume (Network Amplification, CWE-406)     vulnerability in the UDP support of the memcached server     could result in denial of service via network flood     (traffic amplification of 1:50,000 has been reported by     reliable sources). (bsc#1083903)

  - Home directory shouldn't be world readable bsc#1077718

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3588-1 advisory.

    Daniel Shapira discovered an integer overflow issue in Memcached. A remote attacker could use this to     cause a denial of service (daemon crash). (CVE-2017-9951)

    It was discovered that Memcached listened to UDP by default. A remote attacker could use this as part of a     distributed denial of service attack. (CVE-2018-1000115)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199970	RHEL 7 : memcached (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199949	RHEL 6 : memcached (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195371	RHEL 7 : memcached (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195370	RHEL 6 : memcached (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
194093	RHEL 7 : Red Hat OpenStack Platform director (RHSA-2018:1627)	Nessus	Red Hat Local Security Checks	medium
194086	RHEL 7 : Red Hat OpenStack Platform director (RHSA-2018:1593)	Nessus	Red Hat Local Security Checks	medium
194080	RHEL 7 : Red Hat OpenStack Platform 12.0 director (RHSA-2018:2331)	Nessus	Red Hat Local Security Checks	high
194055	RHEL 7 : Red Hat OpenStack Platform 8 director (RHSA-2018:2857)	Nessus	Red Hat Local Security Checks	high
141706	EulerOS Virtualization 3.0.2.2 : memcached (EulerOS-SA-2020-2208)	Nessus	Huawei Local Security Checks	high
138003	EulerOS Virtualization 3.0.6.0 : memcached (EulerOS-SA-2020-1784)	Nessus	Huawei Local Security Checks	high
132166	EulerOS 2.0 SP3 : memcached (EulerOS-SA-2019-2631)	Nessus	Huawei Local Security Checks	high
131883	EulerOS 2.0 SP2 : memcached (EulerOS-SA-2019-2391)	Nessus	Huawei Local Security Checks	high
130675	EulerOS 2.0 SP5 : memcached (EulerOS-SA-2019-2213)	Nessus	Huawei Local Security Checks	high
110386	Debian DSA-4218-1 : memcached - security update	Nessus	Debian Local Security Checks	high
109132	Amazon Linux 2 : memcached (ALAS-2018-964)	Nessus	Amazon Linux Local Security Checks	high
109100	openSUSE Security Update : memcached (openSUSE-2018-373)	Nessus	SuSE Local Security Checks	high
109084	SUSE SLES12 Security Update : memcached (SUSE-SU-2018:0955-1)	Nessus	SuSE Local Security Checks	high
107235	Amazon Linux AMI : memcached (ALAS-2018-964)	Nessus	Amazon Linux Local Security Checks	high
107148	Ubuntu 14.04 LTS / 16.04 LTS : Memcached vulnerabilities (USN-3588-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-1000115

high

Tenable Plugins

high

high

high

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high