The remote host is affected by the vulnerability described in GLSA-201701-12 (memcached: Multiple vulnerabilities)

    Multiple integer overflow vulnerabilities were discovered in memcached.
      Please review the CVE identifiers and Cisco TALOS reports referenced       below for details.
  Impact :

    A remote attacker could abuse memcached&rsquo;s binary protocol leading to       the remote execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2016-8704, CVE-2016-8705, CVE-2016-8706

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for memcached fixes the following security issues :

  - CVE-2016-8704: Server append/prepend remote code     execution (boo#1007871)

  - CVE-2016-8705: Server update remote code execution     (boo#1007870)

  - CVE-2016-8706: Server ASL authentication remote code     execution (boo#1007869)

In addition, memcached was updated to 1.4.33 to include all upstream improvements and bugfixes.

An update for memcached is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es) :

* Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8704, CVE-2016-8705)

* An integer overflow flaw, leading to a heap-based buffer overflow, was found in memcached's parsing of SASL authentication messages. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code.
(CVE-2016-8706)

Update to the latest upstream release, which fixes CVE-2016-8704, CVE-2016-8705, CVE-2016-8706.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - Two integer overflow flaws, leading to heap-based buffer     overflows, were found in the memcached binary protocol.
    An attacker could create a specially crafted message     that would cause the memcached server to crash or,     potentially, execute arbitrary code. (CVE-2016-8704,     CVE-2016-8705)

  - An integer overflow flaw, leading to a heap-based buffer     overflow, was found in memcached's parsing of SASL     authentication messages. An attacker could create a     specially crafted message that would cause the memcached     server to crash or, potentially, execute arbitrary code.
    (CVE-2016-8706)

Aleksandar Nikolic of Cisco Talos discovered several integer overflow vulnerabilities in memcached, a high-performance memory object caching system. A remote attacker can take advantage of these flaws to cause a denial of service (daemon crash), or potentially to execute arbitrary code.

Multiple vulnerabilites have been found in memcached, a high-performance memory object caching system. A remote attacker could take advantage of these flaws to cause a denial of service (daemon crash), or potentially to execute arbitrary code.  

CVE-2013-7291

It was discovered that memcached, when running in verbose mode, can be crashed by sending carefully crafted requests that trigger an unbounded key print, resulting in a daemon crash.

CVE-2016-8704, CVE-2016-8705, CVE-2016-8706

Aleksandar Nikolic of Cisco Talos found several vulnerabilities in memcached. A remote attacker could cause an integer overflow by sending carefully crafted requests to the memcached server, resulting in a daemon crash.

For Debian 7 'Wheezy', these problems have been fixed in version 1.4.13-0.2+deb7u2.

We recommend that you upgrade your memcached packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8704 , CVE-2016-8705)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in memcached's parsing of SASL authentication messages. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code.
(CVE-2016-8706)

ID	Name	Product	Family	Published	Updated	Severity
96243	GLSA-201701-12 : memcached: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/3/2017	1/6/2026	critical
94804	Fedora 23 : memcached (2016-4df986a71f)	Nessus	Fedora Local Security Checks	11/15/2016	1/19/2026	critical
94949	openSUSE Security Update : memcached (openSUSE-2016-1314)	Nessus	SuSE Local Security Checks	11/18/2016	1/16/2026	critical
95356	CentOS 7 : memcached (CESA-2016:2819)	Nessus	CentOS Local Security Checks	11/28/2016	1/16/2026	critical
95611	Fedora 25 : memcached (2016-0c4e822340)	Nessus	Fedora Local Security Checks	12/8/2016	1/15/2026	critical
95866	Scientific Linux Security Update : memcached on SL7.x x86_64 (20161123)	Nessus	Scientific Linux Local Security Checks	12/15/2016	1/8/2026	critical
94521	Debian DSA-3704-1 : memcached - security update	Nessus	Debian Local Security Checks	11/4/2016	1/20/2026	critical
94584	Debian DLA-701-1 : memcached security update	Nessus	Debian Local Security Checks	11/7/2016	1/20/2026	critical
94681	Amazon Linux AMI : memcached (ALAS-2016-761)	Nessus	Amazon Linux Local Security Checks	11/11/2016	1/19/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical