New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks

Thu Mar 1 23:51:41 UTC 2018

> The defaults for Zimbra seem to be to listen everywhere all the time. 
> amidst all the hysterical pontification, i am having trouble finding any 
> release which has, by default, a port 11211 listener on any interface. 

sorry, i should have said "any operating system release"

yes, you can install memcached

yes, you can install some j random container which has memcached

yes, you can shoot yourself in the foot; welcome to the internet

my point was merely that the hysteria and grandstanding can cost a lot
of ops a bunch of time.  and folk should be aware that normal, simple,
vanilla environments will not be a source of reflection.

of course, they might be a target :)

randy