The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a     denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between     signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2016-8705. (CVE-2017-9951)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a
    denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between
    signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists
    because of an incomplete fix for CVE-2016-8705. (CVE-2017-9951)

According to the versions of the memcached packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The try_read_command function in memcached.c in     memcached before 1.4.39 allows remote attackers to     cause a denial of service (segmentation fault) via a     request to add/set a key, which makes a comparison     between signed and unsigned int and triggers a     heap-based buffer over-read. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2016-8705.(CVE-2017-9951)

  - Memcached version 1.5.5 contains an Insufficient     Control of Network Message Volume (Network     Amplification, CWE-406) vulnerability in the UDP     support of the memcached server that can result in     denial of service via network flood (traffic     amplification of 1:50,000 has been reported by reliable     sources). This attack appear to be exploitable via     network connectivity to port 11211 UDP. This     vulnerability appears to have been fixed in 1.5.6 due     to the disabling of the UDP protocol by     default.(CVE-2018-1000115)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-9951     Daniel Shapira reported a heap-based buffer over-read in     memcached (resulting from an incomplete fix for     CVE-2016-8705 ) triggered by specially crafted requests     to add/set a key and allowing a remote attacker to cause     a denial of service.

  - CVE-2018-1000115     It was reported that memcached listens to UDP by     default. A remote attacker can take advantage of it to     use the memcached service as a DDoS amplifier.

  Default installations of memcached in Debian are not affected by   this issue as the installation defaults to listen only on localhost.
  This update disables the UDP port by default. Listening on the UDP   can be re-enabled in the /etc/memcached.conf (cf.
  /usr/share/doc/memcached/NEWS.Debian.gz).

  - CVE-2018-1000127     An integer overflow was reported in memcached, resulting     in resource leaks, data corruption, deadlocks or     crashes.

This update for memcached fixes the following issues :

  - CVE-2017-9951: Fixed heap-based buffer over-read in     try_read_command function which allowed remote attackers     to cause a denial of service attack (bsc#1056865).

This update was imported from the SUSE:SLE-12:Update update project.

This update for memcached fixes the following issues :

  - CVE-2017-9951: Fixed heap-based buffer over-read in     try_read_command function which allowed remote attackers     to cause a denial of service attack (bsc#1056865).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3588-1 advisory.

    Daniel Shapira discovered an integer overflow issue in Memcached. A remote attacker could use this to     cause a denial of service (daemon crash). (CVE-2017-9951)

    It was discovered that Memcached listened to UDP by default. A remote attacker could use this as part of a     distributed denial of service attack. (CVE-2018-1000115)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that there was a remote denial of service (DoS) vulnerability in memcached, a high-performance memory object caching system.

The try_read_command function allowed remote attackers to cause a DoS via a request to add/set a key that makes a comparison between a signed and unsigned integer which triggered a heap-based buffer over-read.

This vulnerability existed due to an incomplete upstream fix for CVE-2016-8705.

For Debian 7 'Wheezy', this issue has been fixed in memcached version 1.4.13-0.2+deb7u3.

We recommend that you upgrade your memcached packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
221518	Linux Distros Unpatched Vulnerability : CVE-2017-9951	Nessus	Misc.	high
405575	Alpine: memcached: security update to 1.4.36-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405575	Alpine: memcached: security update to 1.4.36-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405573	Alpine: memcached: security update to 1.4.33-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405573	Alpine: memcached: security update to 1.4.33-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400870	Alpine: multiple memcached packages: security update to 1.4.38-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400870	Alpine: multiple memcached packages: security update to 1.4.38-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
141706	EulerOS Virtualization 3.0.2.2 : memcached (EulerOS-SA-2020-2208)	Nessus	Huawei Local Security Checks	high
138003	EulerOS Virtualization 3.0.6.0 : memcached (EulerOS-SA-2020-1784)	Nessus	Huawei Local Security Checks	high
132166	EulerOS 2.0 SP3 : memcached (EulerOS-SA-2019-2631)	Nessus	Huawei Local Security Checks	high
131883	EulerOS 2.0 SP2 : memcached (EulerOS-SA-2019-2391)	Nessus	Huawei Local Security Checks	high
130675	EulerOS 2.0 SP5 : memcached (EulerOS-SA-2019-2213)	Nessus	Huawei Local Security Checks	high
110386	Debian DSA-4218-1 : memcached - security update	Nessus	Debian Local Security Checks	high
108782	openSUSE Security Update : memcached (openSUSE-2018-327)	Nessus	SuSE Local Security Checks	high
108746	SUSE SLES12 Security Update : memcached (SUSE-SU-2018:0839-1)	Nessus	SuSE Local Security Checks	high
107148	Ubuntu 14.04 LTS / 16.04 LTS : Memcached vulnerabilities (USN-3588-1)	Nessus	Ubuntu Local Security Checks	high
101856	Debian DLA-1033-1 : memcached security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9951

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high