Memcached - Serious remote code execution bugs

[ASTRAPI]

Hello

There is an updated Memcached version out that fixes a few critical Remote Code Execution bugs and if you use it you must upgrade to latest version:

Memcached 1.4.33

Verify it by running from ssh:

memcached -V

 

Forgot to post earlier this one

Update and stay safe !

 

Overview:

Serious remote code execution bugs are fixed in this release.

The bugs are related to the binary protocol as well as SASL authentication of the binary protocol.

If you do not use the binary protocol at all, a workaround is to start memcached with -B ascii - otherwise you will need the patch in this release.

The diff may apply cleanly to older versions as the affected code has not changed in a long time.

Vulnerability Details:

Multiple integer overflow vulnerabilities exist within Memcached that could be exploited to achieve remote code execution on the targeted system. These vulnerabilities manifest in various Memcached functions that are used in inserting, appending, prepending, or modifying key-value data pairs. Systems which also have Memcached compiled with support for SASL authentication are also vulnerable to a third flaw due to how Memcached handles SASL authentication commands.


An attacker could exploit these vulnerabilities by sending a specifically crafted Memcached command to the targeted server. Additionally, these vulnerabilities could also be exploited to leak sensitive process information which an attacker could use to bypass common exploitation mitigations, such as ASLR, and can be triggered multiple times. This enables reliable exploitation which makes these vulnerabilities severe.

While it's strongly recommend that Memcached servers are setup so that they are only accessible within a trusted environment, many Memcached servers are setup so that they are accessible over the internet. Additionally, administrators should not neglect Memcached deployments in "trusted" environments as attackers may target vulnerable servers to move laterally within a network.

The following is a list of vulnerabilities Talos has identified in Memcached:

• TALOS-2016-0219 - Memcached Server Append/Prepend Remote Code Execution Vulnerability
• TALOS-2016-0220 - Memcached Server Update Remote Code Execution Vulnerability
• TALOS-2016-0221 - Memcached Server SASL Authentication Remote Code Execution Vulnerability

 

Have a nice day !