group.of.nepali.translators team mailing list archive

Thread
Date

[Bug 1752831] Re: memcached should disable UDP by default

To: group.of.nepali.translators@xxxxxxxxxxxxxxxxxxx
From: Steve Beattie <sbeattie@xxxxxxxxxx>
Date: Sat, 03 Mar 2018 06:05:37 -0000
Reply-to: Bug 1752831 <1752831@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Also affects: memcached (Ubuntu Xenial)
   Importance: Undecided
       Status: New

** Also affects: memcached (Ubuntu Artful)
   Importance: Undecided
       Status: New

** Also affects: memcached (Ubuntu Trusty)
   Importance: Undecided
       Status: New

** Changed in: memcached (Ubuntu Trusty)
       Status: New => Triaged

** Changed in: memcached (Ubuntu Xenial)
       Status: New => Triaged

** Changed in: memcached (Ubuntu Artful)
       Status: New => Triaged

** Changed in: memcached (Ubuntu Trusty)
     Assignee: (unassigned) => Steve Beattie (sbeattie)

** Changed in: memcached (Ubuntu Xenial)
     Assignee: (unassigned) => Steve Beattie (sbeattie)

** Changed in: memcached (Ubuntu Artful)
     Assignee: (unassigned) => Steve Beattie (sbeattie)

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1752831

Title:
  memcached should disable UDP by default

Status in memcached package in Ubuntu:
  Fix Released
Status in memcached source package in Trusty:
  Triaged
Status in memcached source package in Xenial:
  Triaged
Status in memcached source package in Artful:
  Triaged

Bug description:
  Memcached is currently involved in some massive ddos attacks, see e.g.:
  https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/

  The UDP protocol of memcached can be abused for very effective DDoS amplification attacks and should therefore be considered dangerous.
  Upstream memcached has reacted to this by disabling UDP by default:
  https://github.com/memcached/memcached/wiki/ReleaseNotes156

  In Ubuntu memcached by default only listens to 127.0.0.1, but enables
  UDP. While the localhost-only protects default settings, it's still
  only a minor change away from creating an effective DDoS tool for a
  protocol that is hardly in use today. I recommend that Ubuntu
  backports the upstream change and disables UDP by default.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/memcached/+bug/1752831/+subscriptions