Lucene search

CVE-2013-2028

🗓️ 20 Jul 2013 03:20:37Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 215 Views🌐 WEB

Remote code execution via ngx_http_parse_chunked in nginx 1.3.9 through 1.4.0

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 47
0day.today	Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow	24 May 201300:00	–	zdt
exploitpack	Nginx 1.4.0 (Generic Linux x64) - Remote Overflow	15 Mar 201400:00	–	exploitpack
exploitpack	Nginx 1.3.9 1.4.0 - Denial of Service (PoC)	17 May 201300:00	–	exploitpack
ALT Linux	Security fix for the ALT Linux 9 package nginx version 1.4.1-alt1	7 May 201300:00	–	altlinux
Prion	Stack overflow	20 Jul 201303:37	–	prion
Prion	Design/Logic Flaw	20 Jul 201303:37	–	prion
Debian CVE	CVE-2013-2028	20 Jul 201303:37	–	debiancve
Debian CVE	CVE-2013-2070	20 Jul 201303:37	–	debiancve
Exploit DB	Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC)	17 May 201300:00	–	exploitdb
Exploit DB	Nginx 1.3.9 < 1.4.0 - Chuncked Encoding Stack Buffer Overflow (Metasploit)	28 May 201300:00	–	exploitdb

Nvd

Node

f5 nginxRange1.3.9–1.4.0

Node

fedoraproject fedoraMatch19

Source	Link
secunia	www.secunia.com/advisories/55181
lists	www.lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html
nginx	www.nginx.org/download/patch.2013.chunked.txt
security	www.security.gentoo.org/glsa/glsa-201310-04.xml
github	www.github.com/rapid7/metasploit-framework/pull/1834
osvdb	www.osvdb.org/93037
securityfocus	www.securityfocus.com/bid/59699
packetstormsecurity	www.packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html
mailman	www.mailman.nginx.org/pipermail/nginx-announce/2013/000112.html
vnsecurity	www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/

Parameter	Position	Path	Description	CWE
Transfer-Encoding	request body	/	Denial of service and potential code execution via crafted chunked Transfer-Encoding request.	CWE-787
data	request body	/	Denial of service and potential code execution via crafted chunked Transfer-Encoding request.	CWE-787

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

20 Jul 2013 03:37Current

7.5High risk

Vulners AI Score7.5

CVSS27.5

EPSS0.91388

CWE-787