1. Ubuntu Security Notices
  2. USN-3588-1

USN-3588-1: Memcached vulnerabilities

Publication date

5 March 2018

Overview

Several security issues were fixed in Memcached.

Releases

Packages

  • memcached - high-performance memory object caching system

Details

Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)

Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)

Update instructions

In general, a standard system update will make all the necessary changes. Please note that after applying this update, Memcached will no longer listen to UDP by default. If UDP service is desired, please add ‘-U 11211’ to /etc/memcached.conf and restart the memcached service.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
17.10 artful memcached –  1.4.33-1ubuntu3.2
16.04 xenial memcached –  1.4.25-2ubuntu1.3
14.04 trusty memcached –  1.4.14-0ubuntu9.2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›