Multiple integer signedness errors in the (1) processbinsaslauth, (2) processbincompletesaslauth, (3) processbinupdate, and (4) processbinappendprepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
Description of problem:
When run with "-vv", on receipt of a binary-protocol deletion request, memcached prints out the key to be deleted in a way that can lead to a buffer overrun and crash.
Version-Release number of selected component (if applicable):
1.4.4, although this currently affects all later versions.
How reproducible:
Run memcached with "-vv", use memrm to send deletion requests and observe output.
Steps to Reproduce:
1. memcached -p 12345 -vv 2>&1 | grep '^Deleting' 2. memrm --servers localhost:12345 --binary ABCDEF xyz 3. Check the output from memcached.
Actual results:
[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyzDEF
Expected results:
[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyz
Additional info:
I've opened a bug report upstream: https://code.google.com/p/memcached/issues/detail?id=306