CVEvulnerability
CVE-2018-1000115
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-03-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-400
Description
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Affected configurations
• memcached memcached 1.5.5
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
• debian debian linux 8.0
• debian debian linux 9.0
• redhat openstack 8
• redhat openstack 9
• redhat openstack 10
• redhat openstack 11
• redhat openstack 12
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://access.redhat.com/errata/RHBA-2018:2140 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1593 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1627 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2331 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2857 Third Party Advisory
- https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html Third Party Advisory
- https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974 Patch, Third Party Advisory
- https://github.com/memcached/memcached/issues/348 Issue Tracking, Third Party Advisory
- https://github.com/memcached/memcached/wiki/ReleaseNotes156 Third Party Advisory
- https://twitter.com/dormando/status/968579781729009664 Third Party Advisory
- https://usn.ubuntu.com/3588-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4218 Third Party Advisory
- https://www.exploit-db.com/exploits/44264/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44265/ Exploit, Third Party Advisory, VDB Entry
- https://www.synology.com/support/security/Synology_SA_18_07 Third Party Advisory
- https://access.redhat.com/errata/RHBA-2018:2140 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1593 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1627 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2331 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2857 Third Party Advisory
- https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html Third Party Advisory
- https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974 Patch, Third Party Advisory
- https://github.com/memcached/memcached/issues/348 Issue Tracking, Third Party Advisory
- https://github.com/memcached/memcached/wiki/ReleaseNotes156 Third Party Advisory
- https://twitter.com/dormando/status/968579781729009664 Third Party Advisory
- https://usn.ubuntu.com/3588-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4218 Third Party Advisory
- https://www.exploit-db.com/exploits/44264/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44265/ Exploit, Third Party Advisory, VDB Entry
- https://www.synology.com/support/security/Synology_SA_18_07 Third Party Advisory