Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Red Hat: RHSA-2016-2820-01 Critical: memcached Buffer Overflow

red hat
Calendar Grey November 23, 2016
Scroller Redhat
Canonical unveils a critical Redis vulnerability patch to fix memory corruption issues. Safeguard your environment.
An update for memcached is now available for Red Hat Enterprise Linux 6

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.
Security Fix(es):
* Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8704, CVE-2016-8705)

Topics%20covered

Topics Covered

security advisory buffer overflow critical remote code execution Red Hat Enterprise Linux important memcached

References

https://access.redhat.com/security/cve/CVE-2016-8704 https://access.redhat.com/security/cve/CVE-2016-8705 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Desktop Optional (v. 6):
Source: memcached-1.4.4-3.el6_8.1.src.rpm
i386: memcached-1.4.4-3.el6_8.1.i686.rpm memcached-debuginfo-1.4.4-3.el6_8.1.i686.rpm memcached-devel-1.4.4-3.el6_8.1.i686.rpm
x86_64: memcached-1.4.4-3.el6_8.1.x86_64.rpm memcached-debuginfo-1.4.4-3.el6_8.1.i686.rpm memcached-debuginfo-1.4.4-3.el6_8.1.x86_64.rpm memcached-devel-1.4.4-3.el6_8.1.i686.rpm memcached-devel-1.4.4-3.el6_8.1.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source: memcached-1.4.4-3.el6_8.1.src.rpm
x86_64: memcached-1.4.4-3.el6_8.1.x86_64.rpm memcached-debuginfo-1.4.4-3.el6_8.1.i686.rpm memcached-debuginfo-1.4.4-3.el6_8.1.x86_64.rpm memcached-devel-1.4.4-3.el6_8.1.i686.rpm memcached-devel-1.4.4-3.el6_8.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: memcached-1.4.4-3.el6_8.1.src.rpm
i386: memcached-1.4.4-3.el6_8.1.i686.rpm memcached-debuginfo-1.4.4-3.el6_8.1.i686.rpm
ppc64: memcached-1.4.4-3.el6_8.1.ppc64.rpm memcached-debuginfo-1.4.4-3.el6_8.1.ppc64.rpm
s390x: memcached-1.4.4-3.el6_8.1.s390x.rpm memcached-debuginfo-1.4.4-3.el6_8.1.s390x.rpm
x86_64: memcached-1.4.4-3.el6_8.1.x86_64.rpm memcached-debuginfo-1.4.4-3.el6_8.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
i386: memcached-debuginfo-1.4.4-3.el6_8.1.i686.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2016:2820-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2820.html
Issue date: 2016-11-23

Topic

An update for memcached is now available for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory buffer overflow critical remote code execution Red Hat Enterprise Linux important memcached

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

1390510 - CVE-2016-8704 memcached: Server append/prepend remote code execution

1390511 - CVE-2016-8705 memcached: Server update remote code execution

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.