Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-1000115 — Uncontrolled Resource Consumption in Memcached

CWE-400 — Uncontrolled Resource Consumption13 documents9 sources
Severity
7.5HIGHNVD
EPSS
82.5%
top 0.77%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
MemcachedCanonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedMar 5
Latest updateMay 13

Description

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debianmemcached/memcached< 1.5.6-1+3
▶Ubuntumemcached/memcached< 1.4.14-0ubuntu9.2+1
▶NVDredhat/openstack5 versions+4

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-f4xm-w85j-gc55: Memcached version 1↗2022-05-13
▶
OSV
memcached vulnerabilities↗2018-03-05
▶
CVEList
CVE-2018-1000115: Memcached version 1↗2018-03-05
▶
OSV
CVE-2018-1000115: Memcached version 1↗2018-03-05
▶

💥Exploits & PoCs

2
Exploit-DB
Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API↗2018-03-08
▶
Exploit-DB
Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)↗2018-03-05
▶

📋Vendor Advisories

3
Ubuntu
Memcached vulnerabilities↗2018-03-05
▶
Red Hat
memcached: UDP server support allows spoofed traffic amplification DoS↗2018-03-02
▶
Debian
CVE-2018-1000115: memcached - Memcached version 1.5.5 contains an Insufficient Control of Network Message Volu...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [openstack-rdo]↗2018-03-06
▶
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS [fedora-all]↗2018-03-05
▶
Bugzilla
CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS↗2018-03-03
▶
CVE-2018-1000115 — Uncontrolled Resource Consumption | cvebase