Memcached 1.6.2 update fixes vulnerability

Submitted by updating the system of caching data in RAM Memcached 1.6.2, in which the vulnerability, which allows you to initiate a workflow crash by sending a specially crafted request. The vulnerability has been manifest since release 1.6.0. As a security workaround, you can disable the binary protocol for external requests by starting with the "-B ascii" option.

The problem is caused by a bug in code parsing the header of the binary protocol, associated with an incorrect determination of the size of the data copied to the buffer when calling the memcpy function (the size is determined based on the parameter specified in the request header). By manipulating the value of a parameter in the binary protocol header, an attacker with the ability to connect to the Memcached network port can initiate a buffer overflow, resulting in a crash of the worker process.

Source: opennet.ru

Add a comment