CVE-2018-1000115
published 2018-03-05CVE-2018-1000115: Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the…
PriorityP274high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
88.37%
99.8th percentile
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | memcached | < memcached 1.5.6-1 (bookworm) | memcached 1.5.6-1 (bookworm) |
| memcached | memcached | — | — |
| memcached | memcached | >= 0 < 1.5.6-1 | 1.5.6-1 |
| memcached | memcached | >= 0 < 1.5.6-1 | 1.5.6-1 |
| memcached | memcached | >= 0 < 1.5.6-1 | 1.5.6-1 |
| memcached | memcached | >= 0 < 1.5.6-1 | 1.5.6-1 |
| memcached | memcached | >= 0 < 1.4.14-0ubuntu9.2 | 1.4.14-0ubuntu9.2 |
| memcached | memcached | >= 0 < 1.4.25-2ubuntu1.3 | 1.4.25-2ubuntu1.3 |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n
bytes↗
\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n
- →Detect UDP packets destined to port 11211 containing the memcached 'stats' command payload (with UDP header magic bytes) as an indicator of amplification attack setup or scanning. ↗
- →Alert on spoofed UDP traffic to port 11211 where the source IP does not match the originating host — indicative of reflection/amplification abuse using forged source addresses. ↗
- →Monitor for high-volume UDP responses from port 11211 to external IPs — traffic amplification ratios of up to 1:50,000 have been observed, making outbound flood from memcached servers a strong signal. ↗
- →Flag memcached servers accessible on UDP port 11211 from the public Internet; Shodan queries for 'product:"Memcached" port:11211' are used by attackers to enumerate targets. ↗
- ·The vulnerability is only exploitable when memcached is listening on UDP port 11211; the fix in version 1.5.6 disables UDP by default. Ensure UDP is disabled or firewalled on all memcached deployments. ↗
- ·Red Hat notes that the default configuration of memcached as shipped in Red Hat products makes it possible to abuse them for DDoS attacks if memcached is exposed to the public Internet. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f4xm-w85j-gc55: Memcached version 1
ghsa_unreviewed·2022-05-13
CVE-2018-1000115 [HIGH] CWE-400 GHSA-f4xm-w85j-gc55: Memcached version 1
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
OSV
memcached vulnerabilities
osv·2018-03-05·CVSS 7.5
CVE-2017-9951 [HIGH] memcached vulnerabilities
memcached vulnerabilities
Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)
It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)
OSV
CVE-2018-1000115: Memcached version 1
osv·2018-03-05·CVSS 7.5
CVE-2018-1000115 [HIGH] CVE-2018-1000115: Memcached version 1
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Ubuntu
Memcached vulnerabilities
vendor_ubuntu·2018-03-05·CVSS 7.5
CVE-2017-9951 [HIGH] Memcached vulnerabilities
Title: Memcached vulnerabilities
Summary: Several security issues were fixed in Memcached.
Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)
It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)
Instructions: In general, a standard system update will make all the necessary changes.
Please note that after applying this update, Memcached will no longer
listen to UDP by default. If UDP service is desired, please add
'-U 11211' to /etc/memcached.conf and restart the memcached service.
Red Hat
memcached: UDP server support allows spoofed traffic amplification DoS
vendor_redhat·2018-03-02·CVSS 7.5
CVE-2018-1000115 [HIGH] memcached: UDP server support allows spoofed traffic amplification DoS
memcached: UDP server support allows spoofed traffic amplification DoS
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send a malicious UDP request using a
Debian
CVE-2018-1000115: memcached - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volu...
vendor_debian·2018·CVSS 7.5
CVE-2018-1000115 [HIGH] CVE-2018-1000115: memcached - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volu...
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Scope: local
bookworm: resolved (fixed in 1.5.6-1)
bullseye: resolved (fixed in 1.5.6-1)
forky: resolved (fixed in 1.5.6-1)
sid: resolved (fixed in 1.5.6-1)
trixie: resolved (fixed in 1.5.6-1)
No detection rules found.
Exploit-DB
Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
exploitdb·2018-03-08
CVE-2018-1000115 Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
---
#-- coding: utf8 --
#!/usr/bin/python
# Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44265.zip
import sys, os, time, shodan
from pathlib import Path
from scapy.all import *
from contextlib import contextmanager
starttime=time.time()
@contextmanager
def suppress_stdout():
with open(os.devnull, "w") as devnull:
old_stdout = sys.stdout
sys.stdout = devnull
try:
yield
finally:
sys.stdout = old_stdout
class color:
HEADER = '\033[0m'
keys = Path("./api.txt")
logo = color.HEADER + '''
███╗ ███╗███████╗███╗ ███╗ ██████╗██████╗ █████╗ ███████╗██╗ ██╗███████╗██████╗
████╗ ████║██╔════╝████╗ ████║██╔════╝██╔══██╗██╔══██╗██╔════╝██║
Exploit-DB
Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)
exploitdb·2018-03-05
CVE-2018-1000115 Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)
Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)
---
/**
memcached-PoC
memcached Proof of Concept Amplification via spoofed source UDP packets. Repo includes source code for PoC and approximately 17,000 AMP hosts.
memcached.c - Source code (https://pastebin.com/raw/ZiUeinae)
memecache-amp-03-05-2018-rd.list - List of memcached servers as of 03-05-2018 (https://pastebin.com/raw/eSCHTTVu)
Compile: gcc memcached.c -o memecached -pthread
*Educational and/or testing purposes only. *Use of these tools against an unauthorized party may be unethtical, rude, and even illegal in some countries.
**/
/*
memcache reflection script
greeting: syn, storm, krashed, chrono, spike, niko, disliked
Use with extreme Caution
*/
#include
#include
#include
#
Metasploit
Memcached Stats Amplification Scanner
metasploit
Memcached Stats Amplification Scanner
Memcached Stats Amplification Scanner
This module can be used to discover Memcached servers which expose the unrestricted UDP port 11211. A basic "stats" request is executed to check if an amplification attack is possible against a third party.
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [openstack-rdo]
bugzilla·2018-03-06·CVSS 7.5
CVE-2018-1000115 [HIGH] CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [openstack-rdo]
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
The fix fo
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [fedora-all]
bugzilla·2018-03-05·CVSS 7.5
CVE-2018-1000115 [HIGH] CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [fedora-all]
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mult
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS
bugzilla·2018-03-03·CVSS 7.5
CVE-2018-1000115 [HIGH] CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS
memcached supports TCP and UDP servers, when the UDP server is enabled, and the configuration does not specify localhost or 127.0.0.1, and the server does not firewall the memcached port (11211 by default) can be exploited for network traffic amplification attacks by spoofed UDP packets.
Please note that by default the firewall on Red Hat Enterprise Linux only allows port 22 (SSH) inbound, so systems with memcached enabled are only affected if a firewall rule is added that allows UDP traffic to connect to memcached (by default on port 11211).
Discussion:
memcached upstream disabled UDP by default in version 1.5.6:
https://github.com/memcached/memcached/wiki/ReleaseNotes156
Relevant upstream commit
arXiv
On generating network traffic datasets with synthetic attacks for intrusion detection
arxiv_fulltext·2019-05-01
On generating network traffic datasets with synthetic attacks for intrusion detection
[On generating network traffic datasets with synthetic attacks for intrusion detection]On generating network traffic datasets with synthetic attacks for intrusion detection
Carlos Garcia Cordero
Technische Universität Darmstadt
Telecooperation Group
Darmstadt
Hessen
64289
Germany
Emmanouil Vasilomanolakis
Aalborg University
Electronic Systems, Center for Communication, Media and Information technologies
Copenhagen
2450
Denmark
Aidmar Wainakh
Max Mühlhäuser
Technische Universität Darmstadt
Telecooperation Group
Darmstadt
Hessen
64289
Germany
Simin Nadjm-Tehrani
Linköping University
Real-time Systems Laboratory
Linköping
S-581 83
Sweden
## Abstract
Most research in the area of intrusion detection requires datasets to develop, evaluate or compare systems in one way or another. In th
https://access.redhat.com/errata/RHBA-2018:2140https://access.redhat.com/errata/RHSA-2018:1593https://access.redhat.com/errata/RHSA-2018:1627https://access.redhat.com/errata/RHSA-2018:2331https://access.redhat.com/errata/RHSA-2018:2857https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.htmlhttps://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974https://github.com/memcached/memcached/issues/348https://github.com/memcached/memcached/wiki/ReleaseNotes156https://twitter.com/dormando/status/968579781729009664https://usn.ubuntu.com/3588-1/https://www.debian.org/security/2018/dsa-4218https://www.exploit-db.com/exploits/44264/https://www.exploit-db.com/exploits/44265/https://www.synology.com/support/security/Synology_SA_18_07https://access.redhat.com/errata/RHBA-2018:2140https://access.redhat.com/errata/RHSA-2018:1593https://access.redhat.com/errata/RHSA-2018:1627https://access.redhat.com/errata/RHSA-2018:2331https://access.redhat.com/errata/RHSA-2018:2857https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.htmlhttps://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974https://github.com/memcached/memcached/issues/348https://github.com/memcached/memcached/wiki/ReleaseNotes156https://twitter.com/dormando/status/968579781729009664https://usn.ubuntu.com/3588-1/https://www.debian.org/security/2018/dsa-4218https://www.exploit-db.com/exploits/44264/https://www.exploit-db.com/exploits/44265/https://www.synology.com/support/security/Synology_SA_18_07
2018-03-05
Published