In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1576 advisory.

    [0:1.5.9-3]
    - fix null-pointer dereference in 'lru mode' and 'lru temp_ttl' (#1709408)
    - CVE-2019-11596

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1576 advisory.

  - memcached: null-pointer dereference in lru mode and lru temp_ttl causing denial of service     (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5583 advisory.

    memcached is a high-performance, distributed memory object caching system,     generic in nature, but intended for use in speeding up dynamic web     applications     by alleviating database load.

    Security Fix(es):

    * null-pointer dereference in lru mode and lru temp_ttl causing denial     of service (CVE-2019-11596)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has memcached packages installed that are affected by a vulnerability:

  - In memcached before 1.5.14, a NULL pointer dereference     was found in the lru mode and lru temp_ttl commands.
    This causes a denial of service when parsing crafted lru     command messages in process_lru_command in memcached.c.
    (CVE-2019-11596)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for memcached fixes the following issues :

Security issue fixed :

CVE-2019-11596: Fixed a NULL pointer dereference in process_lru_command (bsc#1133817).

CVE-2019-15026: Fixed a stack-based buffer over-read (bsc#1149110).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for memcached fixes the following issues :

Security issue fixed :

  - CVE-2019-11596: Fixed a NULL pointer dereference in     process_lru_command (bsc#1133817).

  - CVE-2019-15026: Fixed a stack-based buffer over-read     (bsc#1149110).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1576 advisory.

    memcached is a high-performance, distributed memory object caching system, generic in nature, but intended     for use in speeding up dynamic web applications by alleviating database load.

    Security Fix(es):

    * memcached: null-pointer dereference in lru mode and lru temp_ttl causing denial of service     (CVE-2019-11596)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the memcached package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In memcached before 1.5.14, a NULL pointer dereference     was found in the 'lru mode' and 'lru temp_ttl'     commands. This causes a denial of service when parsing     crafted lru command messages in process_lru_command in     memcached.c.(CVE-2019-11596)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-11596

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-11596

----

Update to the lastest upstream release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3963-1 advisory.

    It was discovered that Memcached incorrectly handled certain lru command messages. A remote attacker could     possibly use this issue to cause Memcached to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180947	Oracle Linux 8 : memcached (ELSA-2020-1576)	Nessus	Oracle Linux Local Security Checks	high
145982	CentOS 8 : memcached (CESA-2020:1576)	Nessus	CentOS Local Security Checks	high
144398	RHEL 7 : memcached (RHSA-2020:5583)	Nessus	Red Hat Local Security Checks	high
138778	NewStart CGSL MAIN 6.01 : memcached Vulnerability (NS-SA-2020-0033)	Nessus	NewStart CGSL Local Security Checks	high
137537	SUSE SLES15 Security Update : memcached (SUSE-SU-2020:1381-1)	Nessus	SuSE Local Security Checks	high
136962	openSUSE Security Update : memcached (openSUSE-2020-721)	Nessus	SuSE Local Security Checks	high
136045	RHEL 8 : memcached (RHSA-2020:1576)	Nessus	Red Hat Local Security Checks	high
135167	SUSE SLES12 Security Update : memcached (SUSE-SU-2020:0843-1)	Nessus	SuSE Local Security Checks	high
131495	EulerOS Virtualization for ARM 64 3.0.3.0 : memcached (EulerOS-SA-2019-2330)	Nessus	Huawei Local Security Checks	high
125184	Fedora 29 : memcached (2019-df4c0ba2db)	Nessus	Fedora Local Security Checks	high
125178	Fedora 30 : memcached (2019-2bd8e73268)	Nessus	Fedora Local Security Checks	high
124561	Ubuntu 18.04 LTS : Memcached vulnerability (USN-3963-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-11596

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high