Sid 1-52476

Rule Documentation
References

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Memcached lru temp_ttl NULL dereference attempt

Rule Explanation

This event is generated when an attacker attempts to trigger a denial of service in Memcached. Impact: Detection of a Denial of Service Attack Details: This rule checks for attempts to trigger a denial of service in Memcached by causing the program to dereference a NULL value. Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2019-11596

CVE Additional Information

CVE-2019-11596

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

Details
Severity		Base Score	7.5
Impact Score	3.6	Exploit Score	3.9
Confidentiality Impact	NONE	Integrity Impact	NONE
Availability Impact	HIGH	Attack Vector	NETWORK
Scope	UNCHANGED	User Interaction	NONE
Authentication		Ease of Access	LOW
Privileges Required	NONE