Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Red Hat 7: RHSA-2016-2819-01 Important: Memcached Buffer Overflow Advisory

red hat
Calendar Grey November 23, 2016
Scroller Redhat
Memcached security notice: Discover critical enhancements and patches for Red Hat Enterprise Linux that affect vulnerability concerns.
An update for memcached is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.
Security Fix(es):
* Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8704, CVE-2016-8705)
* An integer overflow flaw, leading to a heap-based buffer overflow, was found in memcached's parsing of SASL authentication messages. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8706)

Topics%20covered

Topics Covered

security advisory Red Hat buffer overflow remote code execution important memcached

References

https://access.redhat.com/security/cve/CVE-2016-8704 https://access.redhat.com/security/cve/CVE-2016-8705 https://access.redhat.com/security/cve/CVE-2016-8706 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Client Optional (v. 7):
Source: memcached-1.4.15-10.el7_3.1.src.rpm
x86_64: memcached-1.4.15-10.el7_3.1.x86_64.rpm memcached-debuginfo-1.4.15-10.el7_3.1.i686.rpm memcached-debuginfo-1.4.15-10.el7_3.1.x86_64.rpm memcached-devel-1.4.15-10.el7_3.1.i686.rpm memcached-devel-1.4.15-10.el7_3.1.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
Source: memcached-1.4.15-10.el7_3.1.src.rpm
x86_64: memcached-1.4.15-10.el7_3.1.x86_64.rpm memcached-debuginfo-1.4.15-10.el7_3.1.i686.rpm memcached-debuginfo-1.4.15-10.el7_3.1.x86_64.rpm memcached-devel-1.4.15-10.el7_3.1.i686.rpm memcached-devel-1.4.15-10.el7_3.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: memcached-1.4.15-10.el7_3.1.src.rpm
aarch64: memcached-1.4.15-10.el7_3.1.aarch64.rpm memcached-debuginfo-1.4.15-10.el7_3.1.aarch64.rpm
ppc64: memcached-1.4.15-10.el7_3.1.ppc64.rpm memcached-debuginfo-1.4.15-10.el7_3.1.ppc64.rpm
ppc64le: memcached-1.4.15-10.el7_3.1.ppc64le.rpm memcached-debuginfo-1.4.15-10.el7_3.1.ppc64le.rpm
s390x: memcached-1.4.15-10.el7_3.1.s390x.rpm memcached-debuginfo-1.4.15-10.el7_3.1.s390x.rpm
x86_64: memcached-1.4.15-10.el7_3.1.x86_64.rpm memcached-debuginfo-1.4.15-10.el7_3.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
aarch64:

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2016:2819-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2819.html
Issue date: 2016-11-23

Topic

An update for memcached is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat buffer overflow remote code execution important memcached

Relevant Releases Architectures

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

1390510 - CVE-2016-8704 memcached: Server append/prepend remote code execution

1390511 - CVE-2016-8705 memcached: Server update remote code execution

1390512 - CVE-2016-8706 memcached: SASL authentication remote code execution

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.