Bug 1056865 - (CVE-2017-9951) VUL-0: CVE-2017-9951: memcached: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705)
(CVE-2017-9951)
VUL-0: CVE-2017-9951: memcached: Heap-based buffer over-read in try_read_comm...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/181354/
CVSSv3:RedHat:CVE-2016-8705:7.5:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-09-01 14:25 UTC by Marcus Meissner
Modified: 2020-04-24 15:45 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-09-01 14:25:10 UTC
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705. 

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9951

https://github.com/memcached/memcached/wiki/ReleaseNotes1439

http://www.securityfocus.com/bid/96762

https://groups.google.com/forum/message/raw?msg=memcached/ubGWrkmrr4E/nrm1SeVJAQAJ

https://www.twistlock.com/2017/07/13/cve-2017-9951-heap-overflow-memcached-server-1-4-38-twistlock-vulnerability-report/
Comment 1 Bernhard Wiedemann 2017-09-01 16:05:03 UTC
This is an autogenerated message for OBS integration:
This bug (1056865) was mentioned in
https://build.opensuse.org/request/show/520202 Factory / memcached
Comment 2 Dirk Mueller 2018-03-09 09:23:58 UTC
submitted version update to 1.4.39 to Cloud6 and Cloud7 update. Cloud8 has been updated to 1.5.6
Comment 6 Swamp Workflow Management 2018-03-22 16:28:36 UTC
SUSE-SU-2018:0778-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1007869,1007870,1007871,1056865,798458,817781,857188,858676,858677
CVE References: CVE-2011-4971,CVE-2013-0179,CVE-2013-7239,CVE-2013-7290,CVE-2013-7291,CVE-2016-8704,CVE-2016-8705,CVE-2016-8706,CVE-2017-9951
Sources used:
SUSE OpenStack Cloud 7 (src):    memcached-1.4.39-3.3.2
SUSE Enterprise Storage 4 (src):    memcached-1.4.39-3.3.2
Comment 7 Swamp Workflow Management 2018-03-26 13:10:19 UTC
SUSE-SU-2018:0807-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1007869,1007870,1007871,1056865,798458,817781,857188,858676,858677
CVE References: CVE-2011-4971,CVE-2013-0179,CVE-2013-7239,CVE-2013-7290,CVE-2013-7291,CVE-2016-8704,CVE-2016-8705,CVE-2016-8706,CVE-2017-9951
Sources used:
SUSE OpenStack Cloud 6 (src):    memcached-1.4.39-3.3.1
Comment 8 Swamp Workflow Management 2018-03-29 10:13:15 UTC
SUSE-SU-2018:0839-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1056865
CVE References: CVE-2017-9951
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    memcached-1.4.39-4.3.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    memcached-1.4.39-4.3.1
SUSE Linux Enterprise Server 12-SP3 (src):    memcached-1.4.39-4.3.1
SUSE Linux Enterprise Server 12-SP2 (src):    memcached-1.4.39-4.3.1
Comment 9 Swamp Workflow Management 2018-03-30 13:08:21 UTC
openSUSE-SU-2018:0855-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1056865
CVE References: CVE-2017-9951
Sources used:
openSUSE Leap 42.3 (src):    memcached-1.4.39-11.3.1
Comment 12 Petr Gajdos 2018-04-23 10:23:07 UTC
Package submitted for 11/memcached.

I believe all fixed.
Comment 14 Johannes Segitz 2018-04-23 12:13:48 UTC
yes, that's the fix. Thank you for the submit
Comment 15 Swamp Workflow Management 2018-06-08 13:08:34 UTC
SUSE-SU-2018:1601-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1007870,1056865
CVE References: CVE-2016-8705,CVE-2017-9951
Sources used:
SUSE Studio Onsite Runner 1.3 (src):    memcached-1.2.6-5.17.4.1
SUSE Studio Onsite 1.3 (src):    memcached-1.2.6-5.17.4.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    memcached-1.2.6-5.17.4.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    memcached-1.2.6-5.17.4.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    memcached-1.2.6-5.17.4.1
Comment 16 Alexandros Toptsoglou 2020-04-24 15:45:00 UTC
Done