Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 516
Alerts This Week
Warning Icon 1 516

Ubuntu 16.04 LTS, 18.04 LTS, 18.10: 3995-1 Critical Keepalived DDoS

ubuntu
Calendar Grey May 28, 2019
Dist Ubuntu Esm H88
Uncover the Keepalived flaw impacting several Ubuntu releases, enabling denial of service through specially crafted packets.
Keepalived could be made to crash or run programs if it received specially crafted network traffic.

Summary

Keepalived could be made to crash or run programs if it received

specially crafted network traffic.

Software Description:

- keepalived: Failover and monitoring daemon for LVS clusters

Details:

It was discovered that Keepalived incorrectly handled certain HTTP status

response codes. A remote attacker could use this issue to cause Keepalived

to crash, resulting in a denial of service, or possibly execute arbitrary

code.

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu network attack keepalived

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  keepalived                      1:1.3.9-1ubuntu1.1

Ubuntu 18.04 LTS:
  keepalived                      1:1.3.9-1ubuntu0.18.04.2

Ubuntu 16.04 LTS:
  keepalived                      1:1.2.24-1ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3995-1

CVE-2018-19115

Severity
critical
Lowest
Low
Medium
High
Critical

May 28, 2019

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu network attack keepalived

Package Information

https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu1.1
https://launchpad.net/ubuntu/+source/keepalived/1:1.3.9-1ubuntu0.18.04.2
https://launchpad.net/ubuntu/+source/keepalived/1:1.2.24-1ubuntu0.16.04.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.