PT-2019-12406 · Memcached+5 · Memcached+5

Stze · Published 2019-04-10 · Updated 2020-07-29 · CVE-2019-11596

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions memcached versions prior to 1.5.14 ALT Linux (affected versions not specified)

Description A denial of service issue was found in memcached when parsing crafted lru command messages. This issue is related to the "lru mode" and "lru temp ttl" commands in the process lru command function in memcached.c.

Recommendations For memcached versions prior to 1.5.14, update to version 1.5.14 or later to resolve the issue. For ALT Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1852

ALT-PU-2019-1854

CESA-2020_1576

CVE-2019-11596

MGASA-2019-0232

OPENSUSE-SU-2020:0721-1

OPENSUSE-SU-2020_0721-1

RHSA-2020:1576

RHSA-2020:5583

RHSA-2020_1576

SUSE-RU-2020:2072-1

SUSE-SU-2020:0843-1

SUSE-SU-2020:1066-1

SUSE-SU-2020:1190-1

SUSE-SU-2020:1381-1

SUSE-SU-2020_0843-1

SUSE-SU-2020_1381-1

USN-3963-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Memcached

References · 134

• 🔥 https://github.com/memcached/memcached/issues/474 · Exploit
• https://github.com/memcached/memcached/compare/ee1cfe3...50bdc9f · Patch
• https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02 · Patch
• https://advisories.mageia.org/MGASA-2019-0232.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:1381-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11596 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1190-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUE3QBMP5UWTXMPKJREUICH6DIK6SOBX · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11596 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11596 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1576.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1066-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11596 · Vendor Advisory
• https://usn.ubuntu.com/3963-1 · Vendor Advisory