Vulnerabilities identified by Aleksandar Nikolich of Talos.

Our efforts to make the internet safer and protect our customers involves, amongst many other things, researching and identifying zero-day vulnerabilities in the third-party software. As part of our effort to find and responsibly disclose vulnerabilities we identify through our programmatic methods, Talos is disclosing the identification of three vulnerabilities in Memcached. Memcached is an open-source, high-performance, distributed memory caching system used to speed up dynamic websites which rely on a database backend and is widely used in various online applications. Memcached developers have released a patch that address the vulnerabilities we are disclosing today.

Vulnerability Details Multiple integer overflow vulnerabilities exist within Memcached that could be exploited to achieve remote code execution on the targeted system. These vulnerabilities manifest in various Memcached functions that are used in inserting, appending, prepending, or modifying key-value data pairs. Systems which also have Memcached compiled with support for SASL authentication are also vulnerable to a third flaw due to how Memcached handles SASL authentication commands.

An attacker could exploit these vulnerabilities by sending a specifically crafted Memcached command to the targeted server. Additionally, these vulnerabilities could also be exploited to leak sensitive process information which an attacker could use to bypass common exploitation mitigations, such as ASLR, and can be triggered multiple times. This enables reliable exploitation which makes these vulnerabilities severe.

While it's strongly recommend that Memcached servers are setup so that they are only accessible within a trusted environment, many Memcached servers are setup so that they are accessible over the internet. Additionally, administrators should not neglect Memcached deployments in "trusted" environments as attackers may target vulnerable servers to move laterally within a network.

The following is a list of vulnerabilities Talos has identified in Memcached:

• TALOS-2016-0219 - Memcached Server Append/Prepend Remote Code Execution Vulnerability
• TALOS-2016-0220 - Memcached Server Update Remote Code Execution Vulnerability
• TALOS-2016-0221 - Memcached Server SASL Authentication Remote Code Execution Vulnerability
  For more detail on each vulnerability, please refer to the linked vulnerability report or visit the Vulnerability Report portal on our website:

http://www.talosintelligence.com/vulnerability-reports/

Conducting in-depth research to identify zero-day vulnerabilities in third-party software is a task that Talos will continue to undertake to not only protect our customers, but to also improve the security of the internet as a whole. Developing programmatic methods to identify these vulnerabilities, responsibly disclosing them, and making sure they are addressed is key to our efforts. Through this research effort, we help secure software that might otherwise be exploited by adversaries and gain insight into how development practices can be improved.

Coverage The following Snort Rules detect attempts to exploit the vulnerabilities we've disclose for Memcached. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For all current rule information, please refer to your FireSIGHT Management Center or Snort.org.

Snort Rules: 40468-40483