CVE-2018-1000115

HIGH 7.5CVE-2018-1000115 · Published 05/03/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
memcached memcached	`= 1.5.5`	No fix yet
openstack redhat	`= 10= 11= 12= 8= 9`	No fix yet

Description

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

References

access.redhat.com/errata/RHBA-2018:2140 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:1593 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:1627 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2331 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:2857 · Third Party Advisory
blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html · Third Party Advisory
memcached/memcached commit dbb7a8a · Patch
memcached/memcached · Issue Tracking
memcached/memcached · Third Party Advisory
twitter.com/dormando/status/968579781729009664 · Third Party Advisory
usn.ubuntu.com/3588-1 · Third Party Advisory
debian.org/security/2018/dsa-4218 · Third Party Advisory
exploit-db.com/exploits/44264 · Exploit
exploit-db.com/exploits/44265 · Exploit
synology.com/support/security/Synology_SA_18_07 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free