memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

According to the versions of the memcached package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - memcached before 1.4.17, when running in verbose mode,     allows remote attackers to cause a denial of service     (crash) via a request that triggers an 'unbounded key     print' during logging, related to an issue that was     'quickly grepped out of the source tree,' a different     vulnerability than CVE-2013-0179 and     CVE-2013-7290.(CVE-2013-7291)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create     a specially crafted message that would cause the     memcached server to crash or, potentially, execute     arbitrary code.(CVE-2016-8706)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8704)

  - The process_bin_delete function in memcached.c in     memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to     cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the     lack of a null terminator in the key and triggers a     buffer over-read when printing to     stderr.(CVE-2013-0179)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8705)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

  - memcached before 1.4.17 allows remote attackers to     bypass authentication by sending an invalid request     with SASL credentials, then sending another request     with incorrect SASL credentials.(CVE-2013-7239)

  - The do_item_get function in items.c in memcached 1.4.4     and other versions before 1.4.17, when running in     verbose mode, allows remote attackers to cause a denial     of service (segmentation fault) via a request to delete     a key, which does not account for the lack of a null     terminator in the key and triggers a buffer over-read     when printing to stderr, a different vulnerability than     CVE-2013-0179.(CVE-2013-7290)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - The process_bin_delete function in memcached.c in     memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to     cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the     lack of a null terminator in the key and triggers a     buffer over-read when printing to stderr.
    (CVE-2013-0179)

  - memcached before 1.4.17 allows remote attackers to     bypass authentication by sending an invalid request with     SASL credentials, then sending another request with     incorrect SASL credentials. (CVE-2013-7239)

  - The do_item_get function in items.c in memcached 1.4.4     and other versions before 1.4.17, when running in     verbose mode, allows remote attackers to cause a denial     of service (segmentation fault) via a request to delete     a key, which does not account for the lack of a null     terminator in the key and triggers a buffer over-read     when printing to stderr, a different vulnerability than     CVE-2013-0179. (CVE-2013-7290)

  - memcached before 1.4.17, when running in verbose mode,     allows remote attackers to cause a denial of service     (crash) via a request that triggers an 'unbounded key     print' during logging, related to an issue that was     'quickly grepped out of the source tree,' a different     vulnerability than CVE-2013-0179 and CVE-2013-7290.
    (CVE-2013-7291)

memcached was updated to version 1.4.20 to fix five security issues.

These security issues were fixed :

  - DoS when printing out keys to be deleted in verbose mode     (CVE-2013-0179)

  - Remote DoS (crash) via a request that triggers     'unbounded key print' (CVE-2013-7291)

  - Remote DoS (segmentation fault) via a request to delete     a key (CVE-2013-7290)

  - SASL authentication allows wrong credentials to access     memcache (CVE-2013-7239)

  - Remote DoS (CVE-2011-4971)

The remote host is affected by the vulnerability described in GLSA-201406-13 (memcached: Multiple vulnerabilities)

    memcached authentication could be bypassed when using SASL due to a flaw       related to SASL authentication state. Also several heap-based buffer       overflows due to integer conversions when parsing certain length       attributes were discovered.
  Impact :

    A remote attacker could possibly execute       arbitrary code with the privileges of the process, cause a Denial of       Service condition or authenticate with invalid SASL credentials,       bypassing memcached authentication completely.
  Workaround :

    There is no known workaround at this time.

The version of memcached on the remote host has an authentication bypass vulnerability.  This flaw is related to the management of the SASL authentication state.  With a series of specially crafted requests, a remote attacker can authenticate with invalid SASL credentials. Successful exploitation allows the attacker to perform unauthorized actions, which may aid in launching further attacks.

According to its self-reported version, the version of memcached installed on the remote host is a version prior to 1.4.17.  It is, therefore, reportedly affected by the following vulnerabilities :

  - An error exists related to handling SASL requests     that could allow authentication bypasses.
    (CVE-2013-7239)

  - An error exists in the function 'do_item_get' in the     file 'items.c' that could cause buffer overreads and     allow denial of service attacks. (CVE-2013-7290)

  - An error related to logging and verbose mode could     allow some requests to cause denial of service     conditions. (CVE-2013-7291)

Multiple vulnerabilities has been discovered and corrected in memcached :

The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr (CVE-2013-0179).

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials (CVE-2013-7239).

The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179 (CVE-2013-7290).

memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an unbounded key print during logging, related to an issue that was quickly grepped out of the source tree, a different vulnerability than CVE-2013-0179 and CVE-2013-7290 (CVE-2013-7291).

The updated packages have been upgraded to the 1.4.17 version which is unaffected by these issues.

Stefan Bucur discovered that Memcached incorrectly handled certain large body lengths. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service. (CVE-2011-4971)

Jeremy Sowden discovered that Memcached incorrectly handled logging certain details when the -vv option was used. An attacker could use this issue to cause Memcached to crash, resulting in a denial of service. (CVE-2013-0179)

It was discovered that Memcached incorrectly handled SASL authentication. A remote attacker could use this issue to bypass SASL authentication completely. This issue only affected Ubuntu 12.10, Ubuntu 13.04 and Ubuntu 13.10. (CVE-2013-7239).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2011-4971     Stefan Bucur reported that memcached could be caused to     crash by sending a specially crafted packet.

  - CVE-2013-7239     It was reported that SASL authentication could be     bypassed due to a flaw related to the managment of the     SASL authentication state. With a specially crafted     request, a remote attacker may be able to authenticate     with invalid SASL credentials.

ID	Name	Product	Family	Severity
124938	EulerOS Virtualization 3.0.1.0 : memcached (EulerOS-SA-2019-1435)	Nessus	Huawei Local Security Checks	critical
80702	Oracle Solaris Third-Party Patch Update : memcached (multiple_vulnerabilities_in_memcached)	Nessus	Solaris Local Security Checks	medium
76365	openSUSE Security Update : memcached (openSUSE-SU-2014:0867-1)	Nessus	SuSE Local Security Checks	medium
76064	GLSA-201406-13 : memcached: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
72217	memcached SASL Authentication Security Bypass	Nessus	Misc.	medium
72212	memcached < 1.4.17 Multiple Vulnerabilities	Nessus	General	medium
72024	Mandriva Linux Security Advisory : memcached (MDVSA-2014:010)	Nessus	Mandriva Local Security Checks	medium
71938	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : memcached vulnerabilities (USN-2080-1)	Nessus	Ubuntu Local Security Checks	medium
71780	Debian DSA-2832-1 : memcached - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-7239

critical

Tenable Plugins

critical

medium

medium

critical

medium

medium

medium

medium

medium