SB2015011303 - Ubuntu update for Memcached
Published: January 13, 2015
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Buffer access with incorrect length value (CVE-ID: CVE-2011-4971)
CWE-ID: CWE-805 - Buffer Access with Incorrect Length Value
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Green
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions due to a large body length value in a packet. A remote attacker can trigger memory corruption and cause the service to crash.
2) Buffer over-read (CVE-ID: CVE-2013-0179)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to boundary error in the process_bin_delete function when running in verbose mode. A remote attacker can cause the service to crash via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers buffer over-read when printing to stderr.
3) Improper authentication (CVE-ID: CVE-2013-7239)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to bypass authentication on the target system.
The weakness exists due to allowing wrong credentials access. A remote attacker can send an invalid request with SASL credentials, then send another request with incorrect SASL credentials and bypass authentication.
Remediation
Install update from vendor's website.