PT-2018-1892 · Memcached+2 · Memcached+2

Jiejieling · Publicado 2017-07-20 · Atualizado 2024-06-15 · CVE-2018-1000127

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions memcached versions prior to 1.4.37

Description The issue is related to an integer overflow in the memcached data caching software. Exploitation of this issue can be done remotely and may lead to resource leakage, data corruption, deadlock, or crash. The vulnerability is located in the item free() function in items.c and can cause data corruption and deadlocks due to the reuse of items in the hash table from the free list. This attack appears to be exploitable via network connectivity to the memcached service.

Recommendations For memcached versions prior to 1.4.37, update to version 1.4.37 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to the memcached service to minimize the risk of exploitation.

Correção

Integer Overflow

Improper Locking

Enumeração de Fraquezas

CWE-190

CWE-667

Identificadores relacionados

ALT-PU-2017-1914

BDU:2018-01496

CVE-2018-1000127

DLA-1329-1

DSA-4218-1

OPENSUSE-SU-2024:11045-1

RHSA-2018:2290

USN-3601-1

Produtos afetados

Alt Linux

Ubuntu

Memcached

Referências · 23

• https://github.com/memcached/memcached/issues/271 · Nota
• https://github.com/memcached/memcached/wiki/ReleaseNotes1437 · Nota
• https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000127 · Nota de Segurança
• https://suse.com/security/cve/CVE-2020-10931 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000127 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11045-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000127 · Nota
• https://osv.dev/vulnerability/USN-3601-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000127 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1000127 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-1000127 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000115 · Nota
• https://ubuntu.com/security/notices/USN-3601-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-9951 · Nota