Company
Date Published
Author
The Couchbase Team
Word count
1636
Language
English
Hacker News points
None

Summary

The Amazon Web Services team has sent an email to users of memcached, warning them that their instances on Amazon EC2 may have insecure configurations, specifically allowing the whole internet access to the port most commonly used by memcached. The vulnerability is due to leaving the TCP port exposed to the Internet and not using SASL authentication with the binary protocol. To eliminate this vulnerability, users should ensure a firewall protects the system, disable ASCII protocol support and enable SASL authentication on the binary protocol, or use pre-configured memcached images available for deployment on Amazon AWS. The memcached community has been aware of this issue since its development and is working to improve security measures in the software.