NetSight
IP …
high7.5Public exploit code

CVE-2018-1000115

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the mem…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

Affected products

VendorProductAffected versions
MemcachedMemcached
Version 1.5.5
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10
DebianDebian Linux
Versions 8.0, 9.0
RedhatOpenstack
Versions 8, 9, 10, 11, 12

Weakness classification

CWE-400

References