Bug 1551182 (CVE-2018-1000115)
| Summary: | CVE-2018-1000115 memcached: UDP server support allows spoofed traffic amplification DoS | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Kurt Seifried <kseifried> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apevec, apmukher, chrisw, cperry, cswanson, dffrench, drusso, fkrska, hguemar, janne.snabb, jjoyce, jmadigan, jorton, jschluet, jshepherd, kbasil, lgriffin, lhh, lindner, lpeer, markmc, matthew.taylor, matthias, mburns, mlichvar, ngough, pwright, rbryant, rrajasek, rschiron, sclewis, slinaber, slong, tdecacqu, trepel |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | memcached 1.5.6 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of service (DDoS) attacks. A remote attacker could send a malicious UDP request using a spoofed source IP address of a target system to memcached, causing it to send a significantly larger response to the target.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 03:42:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1551654, 1551655, 1551832, 1551833, 1551834, 1551835, 1551836, 1551837, 1551838, 1551839, 1552263, 1552264 | ||
| Bug Blocks: | 1549965 | ||
|
Description
Kurt Seifried
2018-03-03 04:55:19 UTC
memcached upstream disabled UDP by default in version 1.5.6: https://github.com/memcached/memcached/wiki/ReleaseNotes156 Relevant upstream commit: https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974 Statement: Red Hat is aware of traffic amplification distributed denial of service (DDoS) attacks that take advantage of the insecurely configured memcached servers reachable from the public Internet. The default configuration of memcached as shipped in Red Hat products makes it possible to abuse them for these DDoS attacks if memcached is exposed to connections from the public Internet. Refer to the Red Hat Knowledgebase article 3369081 for instructions on how to properly secure memcached installations to prevent them from being used in the attack. https://access.redhat.com/solutions/3369081 Mitigation: Please refer to the Red Hat Knowledgebase article 3369081 for instructions on how to properly secure memcached installations to prevent them from being used in an attack. https://access.redhat.com/solutions/3369081 Note that this issue is further mitigated by the default Fedora configuration, which makes memcached listen on loopback addresses only. The change of this default was done in Fedora 25, see bug 1182542. https://src.fedoraproject.org/rpms/memcached/c/3ee983ab6353cb0613d03913dcc8b7dd3c9637c5 Created memcached tracking bugs for this issue: Affects: fedora-all [bug 1551655] Created memcached tracking bugs for this issue: Affects: openstack-rdo [bug 1551839] *** Bug 1553274 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2018:1593 https://access.redhat.com/errata/RHSA-2018:1593 This issue has been addressed in the following products: Red Hat OpenStack Platform 11.0 (Ocata) Via RHSA-2018:1627 https://access.redhat.com/errata/RHSA-2018:1627 This issue has been addressed in the following products: Red Hat OpenStack Platform 12.0 (Pike) Via RHSA-2018:2331 https://access.redhat.com/errata/RHSA-2018:2331 This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) director Via RHSA-2018:2857 https://access.redhat.com/errata/RHSA-2018:2857 |