CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AI Score
Confidence
Low
EPSS
Percentile
97.1%
nginx is prone to a 1-byte memory overwrite vulnerability.
# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
CPE = "cpe:/a:nginx:nginx";
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.117455");
script_version("2022-09-15T10:11:07+0000");
script_tag(name:"last_modification", value:"2022-09-15 10:11:07 +0000 (Thu, 15 Sep 2022)");
script_tag(name:"creation_date", value:"2021-05-26 05:58:48 +0000 (Wed, 26 May 2021)");
script_tag(name:"cvss_base", value:"6.8");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2022-09-14 15:49:00 +0000 (Wed, 14 Sep 2022)");
script_cve_id("CVE-2021-23017");
script_tag(name:"qod_type", value:"remote_banner_unreliable");
script_tag(name:"solution_type", value:"VendorFix");
script_name("nginx 0.6.18 - 1.20.0 1-byte Memory Overwrite Vulnerability");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
script_family("Web Servers");
script_dependencies("gb_nginx_consolidation.nasl");
script_mandatory_keys("nginx/detected");
script_tag(name:"summary", value:"nginx is prone to a 1-byte memory overwrite vulnerability.");
script_tag(name:"insight", value:"A security issue in nginx resolver was identified, which might
allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response,
resulting in worker process crash or, potentially, in arbitrary code execution.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"affected", value:"nginx version 0.6.18 through 1.20.0.
Note: The issue only affects nginx if the 'resolver' directive is used in the configuration file.
Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS
server.");
script_tag(name:"solution", value:"Update to version 1.20.1, 1.21.0 or later.");
script_xref(name:"URL", value:"http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if( isnull( port = get_app_port( cpe: CPE ) ) )
exit( 0 );
if( ! infos = get_app_version_and_location( cpe: CPE, port: port, exit_no_version: TRUE ) )
exit( 0 );
version = infos["version"];
location = infos["location"];
if( version_in_range( version: version, test_version: "0.6.18", test_version2: "1.20.0" ) ) {
report = report_fixed_ver( installed_version: version, fixed_version: "1.20.1/1.21.0", install_path: location );
security_message( port: port, data: report );
exit( 0 );
}
exit( 99 );
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AI Score
Confidence
Low
EPSS
Percentile
97.1%