Security update for memcached SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0778-1 Final 1 1 2018-03-22T13:15:48Z current 2018-03-22T13:15:48Z 2018-03-22T13:15:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for memcached This update for memcached fixes the following issues: Security issues fixed: - CVE-2011-4971: remote DoS (bsc#817781). - CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458). - CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188). - CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677). - CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676). - CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871). - CVE-2016-8705: Server update remote code execution (bsc#1007870). - CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869). - CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-529,SUSE-Storage-4-2018-529 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ Link for SUSE-SU-2018:0778-1 https://lists.opensuse.org/opensuse-security-announce/2018-03/msg00052.html E-Mail link for SUSE-SU-2018:0778-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1007869 SUSE Bug 1007869 https://bugzilla.suse.com/1007870 SUSE Bug 1007870 https://bugzilla.suse.com/1007871 SUSE Bug 1007871 https://bugzilla.suse.com/1056865 SUSE Bug 1056865 https://bugzilla.suse.com/798458 SUSE Bug 798458 https://bugzilla.suse.com/817781 SUSE Bug 817781 https://bugzilla.suse.com/857188 SUSE Bug 857188 https://bugzilla.suse.com/858676 SUSE Bug 858676 https://bugzilla.suse.com/858677 SUSE Bug 858677 https://www.suse.com/security/cve/CVE-2011-4971/ SUSE CVE CVE-2011-4971 page https://www.suse.com/security/cve/CVE-2013-0179/ SUSE CVE CVE-2013-0179 page https://www.suse.com/security/cve/CVE-2013-7239/ SUSE CVE CVE-2013-7239 page https://www.suse.com/security/cve/CVE-2013-7290/ SUSE CVE CVE-2013-7290 page https://www.suse.com/security/cve/CVE-2013-7291/ SUSE CVE CVE-2013-7291 page https://www.suse.com/security/cve/CVE-2016-8704/ SUSE CVE CVE-2016-8704 page https://www.suse.com/security/cve/CVE-2016-8705/ SUSE CVE CVE-2016-8705 page https://www.suse.com/security/cve/CVE-2016-8706/ SUSE CVE CVE-2016-8706 page https://www.suse.com/security/cve/CVE-2017-9951/ SUSE CVE CVE-2017-9951 page SUSE Enterprise Storage 4 SUSE OpenStack Cloud 7 memcached-1.4.39-3.3.2 memcached-1.4.39-3.3.2 as a component of SUSE Enterprise Storage 4 memcached-1.4.39-3.3.2 as a component of SUSE OpenStack Cloud 7 Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet. CVE-2011-4971 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important 1.8 AV:A/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2011-4971.html CVE-2011-4971 https://bugzilla.suse.com/817781 SUSE Bug 817781 The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr. CVE-2013-0179 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2013-0179.html CVE-2013-0179 https://bugzilla.suse.com/798458 SUSE Bug 798458 memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials. CVE-2013-7239 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2013-7239.html CVE-2013-7239 https://bugzilla.suse.com/857188 SUSE Bug 857188 The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179. CVE-2013-7290 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2013-7290.html CVE-2013-7290 https://bugzilla.suse.com/858677 SUSE Bug 858677 memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290. CVE-2013-7291 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2013-7291.html CVE-2013-7291 https://bugzilla.suse.com/858676 SUSE Bug 858676 An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. CVE-2016-8704 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2016-8704.html CVE-2016-8704 https://bugzilla.suse.com/1007719 SUSE Bug 1007719 https://bugzilla.suse.com/1007866 SUSE Bug 1007866 https://bugzilla.suse.com/1007871 SUSE Bug 1007871 Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. CVE-2016-8705 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2016-8705.html CVE-2016-8705 https://bugzilla.suse.com/1007866 SUSE Bug 1007866 https://bugzilla.suse.com/1007870 SUSE Bug 1007870 https://bugzilla.suse.com/1056865 SUSE Bug 1056865 An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution. CVE-2016-8706 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2016-8706.html CVE-2016-8706 https://bugzilla.suse.com/1007866 SUSE Bug 1007866 https://bugzilla.suse.com/1007869 SUSE Bug 1007869 The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705. CVE-2017-9951 SUSE Enterprise Storage 4:memcached-1.4.39-3.3.2 SUSE OpenStack Cloud 7:memcached-1.4.39-3.3.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/ https://www.suse.com/security/cve/CVE-2017-9951.html CVE-2017-9951 https://bugzilla.suse.com/1007870 SUSE Bug 1007870 https://bugzilla.suse.com/1056865 SUSE Bug 1056865