Lucene search

CERTVU:180065

HistorySep 15, 2009 - 12:00 a.m.

Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability

2009-09-1500:00:00

www.kb.cert.org

154

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.938 High

EPSS

Percentile

99.1%

JSON

Overview

A vulnerability in the nginx web server may allow remote attackers to execute arbitrary code on an affected system.

Description

nginx is an HTTP server and mail proxy server that is available for a number of different platforms. A buffer underflow vulnerability exists in the ngx_http_parse_complex_uri() function when handling specially crafted URIs. Exploitation of this vulnerability would cause the nginx server to write data contained in the URI to heap memory before the allocated buffer.

Impact

As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.

Solution

Upgrade or apply a patch

Updated versions of the nginx package have been released to address this issue. Users should consult the Systems Affected section of this document for information about specific vendors.

Vendor Information

180065

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Debian GNU/Linux __ Affected

Notified: September 05, 2009 Updated: September 14, 2009

Statement Date: September 14, 2009

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

Debian has published Debian Security Advisory DSA-1884 in response to this issue. Users are encouraged to review this advisory and apply the patches it describes.

Vendor References

<http://www.debian.org/security/2009/dsa-1884>

Gentoo Linux __ Affected

Notified: September 05, 2009 Updated: September 21, 2009

Statement Date: September 18, 2009

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The Gentoo Security Team has published Gentoo Linux Security Advisory GLSA 200909-18 in response to this issue. Users are encouraged to review this advisory and apply the patches it refers to.

Vendor References

<http://security.gentoo.org/glsa/glsa-200909-18.xml>

nginx __ Affected

Updated: September 15, 2009

Statement Date: September 05, 2009

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The author of nginx has published the following updated versions of the software to address this issue:

  * Development version: nginx-0.8.15, nginx/Windows-0.8.15, [change log](&lt;http://nginx.net/CHANGES&gt;)
  * Stable version: nginx-0.7.62, nginx/Windows-0.7.62, [change log](&lt;http://nginx.net/CHANGES-0.7&gt;)
  * Legacy stable version: nginx-0.6.39, [change log](&lt;http://nginx.net/CHANGES-0.6&gt;)
  * Legacy version: nginx-0.5.38, [change log](&lt;http://nginx.net/CHANGES-0.5&gt;)

Users of nginx from the original distribution are encouraged to upgrade to one of these versions (or newer, as appropriate). The author has also published a to address this issue.

SUSE Linux __ Not Affected

Notified: September 05, 2009 Updated: September 08, 2009

Statement Date: September 07, 2009

Status

Not Affected

Vendor Statement

as far as I can see we never shipped the nginx web-server.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Sun Microsystems, Inc. __ Not Affected

Notified: September 05, 2009 Updated: September 09, 2009

Statement Date: September 08, 2009

Status

Not Affected

Vendor Statement

Sun Products are not vulnerable, since nginx is not included in any supported Sun product offering. A vulnerable version of nginx is available as an unsupported component of WebStack project, which will be updated to fix this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

The SCO Group __ Not Affected

Notified: September 05, 2009 Updated: September 08, 2009

Statement Date: September 08, 2009

Status

Not Affected

Vendor Statement

SCO does not ship this web server with any of its products and we are therefore not affected by this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Apple Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Conectiva Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Cray Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

DragonFly BSD Project Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

EMC Corporation Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Engarde Secure Linux Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

F5 Networks, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Fedora Project Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

FreeBSD, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Fujitsu Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Hewlett-Packard Company Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Hitachi Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

IBM Corporation Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

IBM eServer Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Infoblox Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Juniper Networks, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Mandriva S. A. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

MontaVista Software, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NEC Corporation Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

NetBSD Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Nokia Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Novell, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

OpenBSD Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Openwall GNU/*/Linux Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

QNX Software Systems Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Red Hat, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

SafeNet Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Silicon Graphics, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Slackware Linux Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Sony Corporation Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Turbolinux Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Ubuntu Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Unisys Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Wind River Systems, Inc. Unknown

Notified: September 05, 2009 Updated: September 06, 2009

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

View all 40 vendors __View less vendors __

CVSS Metrics

Group	Score	Vector
Base	0	AV:–/AC:–/Au:–/C:–/I:–/A:–
Temporal	0	E:ND/RL:ND/RC:ND
Environmental	0	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Acknowledgements

Thanks to Chris Ries of the Carnegie Mellon University Information Security Office for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs:	CVE-2009-2629
Severity Metric:	4.22 Date Public:

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.938 High

EPSS

Percentile

99.1%

JSON

Related for VU:180065