Bug 314597 – <net-misc/memcached-1.4.5: DoS (CVE-2010-1152)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Stefan Behte (RETIRED) 2010-04-11 00:09:00 UTC]

FYI, this issue was recently pointed out to me:
> http://code.google.com/p/memcached/issues/detail?id=102
> 
> A remote attacker who is allowed to connect to memcached can crash
> the server by sending bad input. I've not investigated this to see if it
> is more than a DoS.
> 
> People wanting to fix this may want to more thoroughly look at the
> patch[1]. After a cursory glance at it, I'm not sure it is enough:
> 1. it uses:
>   if (strcmp(ptr, "get ") && strcmp(ptr, "gets ")) {
> 
> Why not use something like (*totally* untested):
>   if (strncmp(ptr, "get ", 5) && strncmp(ptr, "gets ", 5)) {
> 
> just in case ptr is not NULL terminated? I haven't checked if this is
> an
> actual issue, but it certainly wouldn't hurt. '5' should probably be
> changed to something more reasonable.
> 
> 2. As I read the patch, couldn't an attacker send crafted input after
> the 4 reallocs and then achieve the same thing (a DoS)?. Perhaps this
> isn't a problem since it limits the object size to 1MB (according to
> the
> FAQ [2]).
> 
> 
> [1]http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9
> [2]http://code.google.com/p/memcached/wiki/FAQ
>

[Comment 1 Stefan Behte (RETIRED) 2010-04-11 00:11:32 UTC]

1.2.8, 1.4.5 are already in the tree, can they go stable?

[Comment 2 Alex Legler (RETIRED) 2010-04-22 17:36:23 UTC]

*** Bug 316703 has been marked as a duplicate of this bug. ***

[Comment 3 Alex Legler (RETIRED) 2010-04-22 17:36:49 UTC]

CVE-2010-1152 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1152):
  memcached.c in memcached before 1.4.3 allows remote attackers to
  cause a denial of service (daemon hang or crash) via a long line that
  triggers excessive memory allocation.  NOTE: some of these details
  are obtained from third party information.

[Comment 4 Alex Legler (RETIRED) 2010-04-22 17:37:17 UTC]

Rerated bug.
Robin, please advise.

[Comment 5 Robin Johnson 2010-04-22 18:08:45 UTC]

arches, please stabilize

target keywords:
alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86

test instructions:
FEATURES=test emerge memcached

[Comment 6 Robin Johnson 2010-04-22 18:09:28 UTC]

missed aliases. Arches, please see stablereq in comment 5.

[Comment 7 Alex Legler (RETIRED) 2010-04-22 18:17:36 UTC]

Arches, please test and mark stable:
=net-misc/memcached-1.4.5

Target keywords and instructions as per comment 5.

[Comment 8 Myckel Habets 2010-04-22 20:14:06 UTC]

Build and tested on x86. Please mark stable for x86.

[Comment 9 Christian Faulhammer (RETIRED) 2010-04-23 09:33:24 UTC]

stable x86, thanks Myckel

[Comment 10 Jeroen Roovers (RETIRED) 2010-04-23 15:06:04 UTC]

Stable for HPPA.

[Comment 11 Raúl Porcel (RETIRED) 2010-04-24 19:41:25 UTC]

alpha/arm/ia64/sh/sparc stable

[Comment 12 Markus Meier 2010-04-26 19:05:58 UTC]

amd64 stable

[Comment 13 Brent Baude (RETIRED) 2010-04-30 14:27:33 UTC]

ppc done

[Comment 14 Brent Baude (RETIRED) 2010-04-30 14:29:10 UTC]

ppc64 done too

[Comment 15 Tim Sammut (RETIRED) 2010-11-20 17:36:41 UTC]

GLSA Vote: yes.

[Comment 16 Stefan Behte (RETIRED) 2010-11-21 16:30:58 UTC]

Vote: NO, your memcached shouldn't be directly reachable from rogue networks anyway and it's "just" DoS.

[Comment 17 Sune Kloppenborg Jeppesen (RETIRED) 2011-01-03 20:44:18 UTC]

Old and DoS only so GLSA Vote: no -> Closing. Feel free to reopen if you disagree.