Network amplification in memcached - CVE-2018-1000115

Vulnerability identifier: #VU11194

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000115

CWE-ID: CWE-406

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote unauthenticated attacker to conduct DDoS amplification attack against the target system.

The weakness exists due to insufficient control of network message volume. A remote attacker can scan for affected, insecure Memcached servers via UDP port 11211,spoof UDP packets, send a specially crafted request, trigger a response and conduct DDoS amplification attack.

memcached
Debian Linux
Ubuntu
Fedora
memcached (Alpine package)
memcached
Red Hat OpenStack
Red Hat OpenStack for IBM Power

Update to version 1.5.6.

memcached (Alpine package) - update to 1.4.33-r2
memcached - addressed in versions 1.4.39-2.fc26, 1.5.7-1.fc27

• Exploit #5081 - Exploit (CVE Documenting Sample) (January 26, 2021)
• Exploit #68 - Memcached Stats Amplification Scanner (March 18, 2020)

• https://github.com/memcached/memcached/wiki/ReleaseNotes156

• Ubuntu update for Memcached
• Debian update for memcached
• Red Hat update for Memcached
• Red Hat update for Memcached
• Red Hat update for Red Hat OpenStack Platform 8 director
• Network amplification in memcached (Alpine package)
• Fedora 27 update for memcached
• Fedora 26 update for memcached