According to the versions of the memcached package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8704)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8705)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create     a specially crafted message that would cause the     memcached server to crash or, potentially, execute     arbitrary code.(CVE-2016-8706)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2016-957:03 advisory.

    memcached is a high-performance, distributed memory object caching     system, generic in nature, but intended for use in speeding up dynamic     web applications by alleviating database load.
    Security issues fixed with this release:
    CVE-2016-8704
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8705
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-8706
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3120-1 advisory.

    Aleksandar Nikolic discovered that Memcached incorrectly handled certain malformed commands. A remote     attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2819 advisory.

    memcached is a high-performance, distributed memory object caching system, generic in nature, but intended     for use in speeding up dynamic web applications by alleviating database load.

    Security Fix(es):

    * Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary     protocol. An attacker could create a specially crafted message that would cause the memcached server to     crash or, potentially, execute arbitrary code. (CVE-2016-8704, CVE-2016-8705)

    * An integer overflow flaw, leading to a heap-based buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create a specially crafted message that would cause the     memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8706)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the memcached package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - memcached before 1.4.17, when running in verbose mode,     allows remote attackers to cause a denial of service     (crash) via a request that triggers an 'unbounded key     print' during logging, related to an issue that was     'quickly grepped out of the source tree,' a different     vulnerability than CVE-2013-0179 and     CVE-2013-7290.(CVE-2013-7291)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create     a specially crafted message that would cause the     memcached server to crash or, potentially, execute     arbitrary code.(CVE-2016-8706)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8704)

  - The process_bin_delete function in memcached.c in     memcached 1.4.4 and other versions before 1.4.17, when     running in verbose mode, allows remote attackers to     cause a denial of service (segmentation fault) via a     request to delete a key, which does not account for the     lack of a null terminator in the key and triggers a     buffer over-read when printing to     stderr.(CVE-2013-0179)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.(CVE-2016-8705)

  - memcached version prior to 1.4.37 contains an Integer     Overflow vulnerability in items.c:item_free() that can     result in data corruption and deadlocks due to items     existing in hash table being reused from free list.
    This attack appear to be exploitable via network     connectivity to the memcached service. This     vulnerability appears to have been fixed in 1.4.37 and     later.(CVE-2018-1000127)

  - memcached before 1.4.17 allows remote attackers to     bypass authentication by sending an invalid request     with SASL credentials, then sending another request     with incorrect SASL credentials.(CVE-2013-7239)

  - The do_item_get function in items.c in memcached 1.4.4     and other versions before 1.4.17, when running in     verbose mode, allows remote attackers to cause a denial     of service (segmentation fault) via a request to delete     a key, which does not account for the lack of a null     terminator in the key and triggers a buffer over-read     when printing to stderr, a different vulnerability than     CVE-2013-0179.(CVE-2013-7290)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Cisco Talos reports :

Multiple integer overflow vulnerabilities exist within Memcached that could be exploited to achieve remote code execution on the targeted system. These vulnerabilities manifest in various Memcached functions that are used in inserting, appending, prepending, or modifying key-value data pairs. Systems which also have Memcached compiled with support for SASL authentication are also vulnerable to a third flaw due to how Memcached handles SASL authentication commands.

An attacker could exploit these vulnerabilities by sending a specifically crafted Memcached command to the targeted server.
Additionally, these vulnerabilities could also be exploited to leak sensitive process information which an attacker could use to bypass common exploitation mitigations, such as ASLR, and can be triggered multiple times. This enables reliable exploitation which makes these vulnerabilities severe.

Security fix for CVE-2016-8704, CVE-2016-8705, CVE-2016-8706

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for memcached fixes the following security issues :

  - CVE-2016-8704: Server append/prepend remote code     execution (boo#1007871)

  - CVE-2016-8705: Server update remote code execution     (boo#1007870)

  - CVE-2016-8706: Server ASL authentication remote code     execution (boo#1007869)

According to the versions of the memcached package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Two integer overflow flaws, leading to heap-based     buffer overflows, were found in the memcached binary     protocol. An attacker could create a specially crafted     message that would cause the memcached server to crash     or, potentially, execute arbitrary code.
    (CVE-2016-8704, CVE-2016-8705)

  - An integer overflow flaw, leading to a heap-based     buffer overflow, was found in memcached's parsing of     SASL authentication messages. An attacker could create     a specially crafted message that would cause the     memcached server to crash or, potentially, execute     arbitrary code.(CVE-2016-8706)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
124899	EulerOS Virtualization for ARM 64 3.0.1.0 : memcached (EulerOS-SA-2019-1396)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
289848	MiracleLinux 7 : memcached-1.4.15-10.el7.1 (AXSA:2016-957:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
94509	Ubuntu 14.04 LTS / 16.04 LTS : Memcached vulnerabilities (USN-3120-1)	Nessus	Ubuntu Local Security Checks	2016/11/3	2024/8/27	critical
95291	RHEL 7 : memcached (RHSA-2016:2819)	Nessus	Red Hat Local Security Checks	2016/11/23	2026/1/16	critical
124938	EulerOS Virtualization 3.0.1.0 : memcached (EulerOS-SA-2019-1435)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
94459	FreeBSD : memcached -- multiple vulnerabilities (f4bf713f-6ac7-4b76-8980-47bf90c5419f)	Nessus	FreeBSD Local Security Checks	2016/11/2	2026/1/20	critical
94814	Fedora 24 : memcached (2016-66c70cadb4)	Nessus	Fedora Local Security Checks	2016/11/15	2026/1/19	critical
94948	openSUSE Security Update : memcached (openSUSE-2016-1313)	Nessus	SuSE Local Security Checks	2016/11/18	2026/1/16	critical
99845	EulerOS 2.0 SP1 : memcached (EulerOS-SA-2016-1086)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical