Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.2.2020.2208
Category:Huawei EulerOS Local Security Checks
Title:Huawei EulerOS: Security Advisory for memcached (EulerOS-SA-2020-2208)
Summary:The remote host is missing an update for the Huawei EulerOS; 'memcached' package(s) announced via the EulerOS-SA-2020-2208 advisory.
Description:Summary:
The remote host is missing an update for the Huawei EulerOS
'memcached' package(s) announced via the EulerOS-SA-2020-2208 advisory.

Vulnerability Insight:
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.(CVE-2017-9951)

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.(CVE-2018-1000115)

Affected Software/OS:
'memcached' package(s) on Huawei EulerOS Virtualization 3.0.2.2.

Solution:
Please install the updated package(s).

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2017-9951
BugTraq ID: 99874
http://www.securityfocus.com/bid/99874
Debian Security Information: DSA-4218 (Google Search)
https://www.debian.org/security/2018/dsa-4218
https://github.com/memcached/memcached/wiki/ReleaseNotes1439
https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ
https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/
https://usn.ubuntu.com/3588-1/
CopyrightCopyright (C) 2020 Greenbone Networks GmbH

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.