CVE-2018-1000115 : Memcached version 1.5.5 contains an Insufficient Control of Network Message Volu

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

Published 2018-03-05 14:29:00

Updated 2021-08-04 17:15:36

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2018-1000115

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 10
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 11
cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 9
cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 12
cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*
Matching versions
Redhat » Openstack » Version: 8
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 17.10
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Matching versions
Memcached » Memcached » Version: 1.5.5
cpe:2.3:a:memcached:memcached:1.5.5:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-1000115

Top countries where our scanners detected CVE-2018-1000115

Top open port discovered on systems with this issue 11211

IPs affected by CVE-2018-1000115 21

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-1000115!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-1000115

EPSS FAQ

86.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-1000115

Memcached Stats Amplification Scanner

Disclosure Date: 2018-02-27

First seen: 2020-04-26

auxiliary/scanner/memcached/memcached_amp

This module can be used to discover Memcached servers which expose the unrestricted UDP port 11211. A basic "stats" request is executed to check if an amplification attack is possible against a third party. Authors: - Marek Majkowski - xistence <xistence@0x9

More information

CVSS scores for CVE-2018-1000115

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-1000115

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1000115

https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974

disable UDP port by default · memcached/memcached@dbb7a8a · GitHub
Patch;Third Party Advisory
https://twitter.com/dormando/status/968579781729009664

dormando on Twitter: "For what it's worth, if you're getting attacked by memcached's, it's pretty easy to disable them since the source won't be spoofed. They may accept "shutdown\r\n", but also runni
Third Party Advisory
https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html

Memcached-fueled 1.3 Tbps attacks - The Akamai Blog
Third Party Advisory
https://www.exploit-db.com/exploits/44264/

Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)
Exploit;Third Party Advisory;VDB Entry
https://github.com/memcached/memcached/wiki/ReleaseNotes156

ReleaseNotes156 · memcached/memcached Wiki · GitHub
Third Party Advisory
https://www.synology.com/support/security/Synology_SA_18_07

Synology Inc.
Third Party Advisory
https://github.com/memcached/memcached/issues/348

UDP Amplification Attacks, result of Memcached UDP port 11211 · Issue #348 · memcached/memcached · GitHub
Issue Tracking;Third Party Advisory
https://access.redhat.com/errata/RHBA-2018:2140

RHBA-2018:2140 - Bug Fix Advisory - Red Hat Customer Portal
Third Party Advisory
https://www.debian.org/security/2018/dsa-4218

Debian -- Security Information -- DSA-4218-1 memcached
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2018:2857

RHSA-2018:2857 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://usn.ubuntu.com/3588-1/

USN-3588-1: Memcached vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2018:2331

RHSA-2018:2331 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://www.exploit-db.com/exploits/44265/

Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
Exploit;Third Party Advisory;VDB Entry
https://access.redhat.com/errata/RHSA-2018:1593

RHSA-2018:1593 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2018:1627

RHSA-2018:1627 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-1000115