Security update for memcached SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1326-1 Final 1 1 2018-05-16T19:48:48Z current 2018-05-16T19:48:48Z 2018-05-16T19:48:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for memcached This update for memcached fixes the following issues: - CVE-2018-1000115: Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server could result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). (bsc#1083903) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-memcached-13608,slestso13-memcached-13608 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181326-1/ Link for SUSE-SU-2018:1326-1 https://lists.suse.com/pipermail/sle-security-updates/2018-May/004061.html E-Mail link for SUSE-SU-2018:1326-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1083903 SUSE Bug 1083903 https://www.suse.com/security/cve/CVE-2018-1000115/ SUSE CVE CVE-2018-1000115 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 SUSE Studio Onsite Runner 1.3 memcached-1.2.6-5.17.3.1 memcached-1.2.6-5.17.3.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 memcached-1.2.6-5.17.3.1 as a component of SUSE Studio Onsite 1.3 memcached-1.2.6-5.17.3.1 as a component of SUSE Studio Onsite Runner 1.3 Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default. CVE-2018-1000115 SUSE Linux Enterprise Software Development Kit 11 SP4:memcached-1.2.6-5.17.3.1 SUSE Studio Onsite 1.3:memcached-1.2.6-5.17.3.1 SUSE Studio Onsite Runner 1.3:memcached-1.2.6-5.17.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181326-1/ https://www.suse.com/security/cve/CVE-2018-1000115.html CVE-2018-1000115 https://bugzilla.suse.com/1083903 SUSE Bug 1083903