Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 08 Apr 2010 11:57:39 -0500
From: Jamie Strandboge <>
Cc: Jos Boumans <>, Mathias Gug <>, Thierry Carrez <>
Subject: CVE request -- memcached

FYI, this issue was recently pointed out to me:

A remote attacker who is allowed to connect to memcached can crash the
server by sending bad input. I've not investigated this to see if it is
more than a DoS.

People wanting to fix this may want to more thoroughly look at the
patch[1]. After a cursory glance at it, I'm not sure it is enough:
1. it uses:
  if (strcmp(ptr, "get ") && strcmp(ptr, "gets ")) {

Why not use something like (*totally* untested):
  if (strncmp(ptr, "get ", 5) && strncmp(ptr, "gets ", 5)) {

just in case ptr is not NULL terminated? I haven't checked if this is an
actual issue, but it certainly wouldn't hurt. '5' should probably be
changed to something more reasonable.

2. As I read the patch, couldn't an attacker send crafted input after
the 4 reallocs and then achieve the same thing (a DoS)?. Perhaps this
isn't a problem since it limits the object size to 1MB (according to the
FAQ [2]).


Jamie Strandboge             |

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.