memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

  - The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a     denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between     signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2016-8705. (CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification,     CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via     network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack     appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have     been fixed in 1.5.6 due to the disabling of the UDP protocol by default. (CVE-2018-1000115)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

  - Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth,     (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow     remote attackers to cause a denial of service (crash) via a large body length value in a packet.
    (CVE-2011-4971)

  - The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the lack of a null terminator in the key and triggers     a buffer over-read when printing to stderr. (CVE-2013-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2290 advisory.

    memcached is a high-performance, distributed memory object caching system, generic in nature, but intended     for use in speeding up dynamic web applications by alleviating database load.

    Security fix(es):

    * memcached: Integer Overflow in items.c:item_free() (CVE-2018-1000127)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - memcached before 1.4.17, when running in verbose mode,     allows remote attackers to cause a denial of service     (crash) via a request that triggers an 'unbounded key     print' during logging, related to an issue that was     'quickly grepped out of the source tree,' a different     vulnerability than CVE-2013-0179 and     CVE-2013-7290.(CVE-2013-7291)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create     a specially crafted message that would cause the     memcached server to crash or, potentially, execute     arbitrary code.(CVE-2016-8706)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8704)

  - The process_bin_delete function in memcached.c in     memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to     cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the     lack of a null terminator in the key and triggers a     buffer over-read when printing to     stderr.(CVE-2013-0179)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8705)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

  - memcached before 1.4.17 allows remote attackers to     bypass authentication by sending an invalid request     with SASL credentials, then sending another request     with incorrect SASL credentials.(CVE-2013-7239)

  - The do_item_get function in items.c in memcached 1.4.4     and other versions before 1.4.17, when running in     verbose mode, allows remote attackers to cause a denial     of service (segmentation fault) via a request to delete     a key, which does not account for the lack of a null     terminator in the key and triggers a buffer over-read     when printing to stderr, a different vulnerability than     CVE-2013-0179.(CVE-2013-7290)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-9951     Daniel Shapira reported a heap-based buffer over-read in     memcached (resulting from an incomplete fix for     CVE-2016-8705 ) triggered by specially crafted requests     to add/set a key and allowing a remote attacker to cause     a denial of service.

  - CVE-2018-1000115     It was reported that memcached listens to UDP by     default. A remote attacker can take advantage of it to     use the memcached service as a DDoS amplifier.

  Default installations of memcached in Debian are not affected by   this issue as the installation defaults to listen only on localhost.
  This update disables the UDP port by default. Listening on the UDP   can be re-enabled in the /etc/memcached.conf (cf.
  /usr/share/doc/memcached/NEWS.Debian.gz).

  - CVE-2018-1000127     An integer overflow was reported in memcached, resulting     in resource leaks, data corruption, deadlocks or     crashes.

According to the version of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In SQLite through 3.22.0, databases whose schema is     corrupted using a CREATE TABLE AS statement could cause     a NULL pointer dereference, related to build.c and     prepare.c.(CVE-2018-8740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

memcached version prior to 1.4.37 contains an Integer Overflow vulnerability that can result in data corruption and deadlocks. This attack is exploitable via network connectivity to the memcached service.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.13-0.2+deb7u4.

We recommend that you upgrade your memcached packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Memcached incorrectly handled reusing certain items. A remote attacker could possibly use this issue to cause Memcached to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199970	RHEL 7 : memcached (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199949	RHEL 6 : memcached (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194042	RHEL 7 : memcached (RHSA-2018:2290)	Nessus	Red Hat Local Security Checks	high
131883	EulerOS 2.0 SP2 : memcached (EulerOS-SA-2019-2391)	Nessus	Huawei Local Security Checks	high
124938	EulerOS Virtualization 3.0.1.0 : memcached (EulerOS-SA-2019-1435)	Nessus	Huawei Local Security Checks	critical
110841	EulerOS 2.0 SP3 : memcached (EulerOS-SA-2018-1177)	Nessus	Huawei Local Security Checks	high
110386	Debian DSA-4218-1 : memcached - security update	Nessus	Debian Local Security Checks	high
110142	EulerOS 2.0 SP1 : memcached (EulerOS-SA-2018-1138)	Nessus	Huawei Local Security Checks	high
108729	Debian DLA-1329-1 : memcached security update	Nessus	Debian Local Security Checks	high
108484	Ubuntu 14.04 LTS / 16.04 LTS : Memcached vulnerability (USN-3601-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-1000127

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high