memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation. NOTE: some of these details are obtained from third party information.

Remote attackers that are allowed to connect to memcached could crash memcached by sending invalid input (CVE-2010-1152).

The remote host is running memcached, a distributed memory object caching system.  The installed version of memcached is earlier than 1.4.3.  Such versions are potentially affected by a denial of service vulnerability because the application continues to read in new data, reallocating its input buffer until a newline character is received which could lead to excessive memory consumption.  An attacker, exploiting this flaw, could crash the affected service.

The version of memcached on the remote host has a denial of service vulnerability.  When processing a client request, the service continually reads in new data, reallocating its input buffer until a newline character is received.  This could result in excessive memory consumption.

A remote attacker could exploit this to crash memcached.

ID	Name	Product	Family	Severity
46751	openSUSE Security Update : memcached (openSUSE-SU-2010:0303-1)	Nessus	SuSE Local Security Checks	medium
46750	openSUSE Security Update : memcached (openSUSE-SU-2010:0303-1)	Nessus	SuSE Local Security Checks	medium
46749	openSUSE Security Update : memcached (openSUSE-SU-2010:0303-1)	Nessus	SuSE Local Security Checks	medium
5514	Memcached < 1.4.3 No Newline Memory Consumption DoS	Nessus Network Monitor	Generic	medium
45579	memcached No Newline Memory Consumption DoS	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2010-1152

high

Tenable Plugins

medium

medium

medium

medium

medium