|Category:||Huawei EulerOS Local Security Checks|
|Title:||Huawei EulerOS: Security Advisory for memcached (EulerOS-SA-2020-2208)|
|Summary:||The remote host is missing an update for the Huawei EulerOS; 'memcached' package(s) announced via the EulerOS-SA-2020-2208 advisory.|
The remote host is missing an update for the Huawei EulerOS
'memcached' package(s) announced via the EulerOS-SA-2020-2208 advisory.
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.(CVE-2017-9951)
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.(CVE-2018-1000115)
'memcached' package(s) on Huawei EulerOS Virtualization 188.8.131.52.
Please install the updated package(s).
Common Vulnerability Exposure (CVE) ID: CVE-2017-9951|
BugTraq ID: 99874
Debian Security Information: DSA-4218 (Google Search)
|Copyright||Copyright (C) 2020 Greenbone Networks GmbH|
|This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.