Vulnerability in memcached - security update
Summary
DLA-701-1: memcached - security update. Affects memcached versions < 1.4.13-0.2+deb7u2. Fixed in 1.4.13-0.2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Memcached is a high-performance memory object caching system. It is designed to speed up dynamic web applications by alleviating database load. Memcached stores data in memory and retrieves it quickly when requested. It is widely used to improve the performance of websites and web applications. However, multiple vulnerabilities have been discovered in memcached that could be exploited by remote attackers.
Vulnerability Detail
The first vulnerability, identified as CVE-2013-7291, affects memcached when running in verbose mode. An attacker can crash the daemon by sending carefully crafted requests that trigger an unbounded key print. This vulnerability can lead to a denial of service attack.
The second set of vulnerabilities, identified as CVE-2016-8704, CVE-2016-8705, and CVE-2016-8706, were found by Aleksandar Nikolic of Cisco Talos. These vulnerabilities involve integer overflow issues that can be exploited by sending specially crafted requests to the memcached server. If successful, these attacks can cause a daemon crash.
How To Fix
Minimum fixed version
1.4.13-0.2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade memcachedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update to ensure the integrity and security of your memcached installation.
Conclusion
Multiple vulnerabilities have been identified in memcached that can lead to a denial of service attack or potential execution of arbitrary code. It is crucial to upgrade your memcached packages to the recommended version to mitigate these security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for memcached →
FAQ
Memcached is a high-performance memory object caching system used to speed up dynamic web applications.
These vulnerabilities can lead to a denial of service attack or potential execution of arbitrary code.
An attacker can crash the memcached daemon by sending carefully crafted requests in verbose mode.
CVE-2013-7291 was discovered by an unknown researcher, while CVE-2016-8704, CVE-2016-8705, and CVE-2016-8706 were found by Aleksandar Nikolic of Cisco Talos.
To fix these vulnerabilities, upgrade your memcached packages to version 1.4.13-0.2+deb7u2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for memcached.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
