7318 matches found
nginx: Remote execution of arbitrary code
Background nginx is a robust, small and high performance HTTP and reverse proxy server. Description Chris Ries reported a heap-based buffer underflow in the ngxhttpparsecomplexuri function in http/ngxhttpparse.c when parsing the request URI. Impact A remote attacker might send a specially crafted...
nginx代理DNS缓存域欺骗漏洞
BUGTRAQ ID: 36438 nginx是多平台的HTTP服务器和邮件代理服务器。 nginx对解析过的域名维护一个内部的DNS缓存，但在搜素缓存时，nginx仅检查名称的crc32是否匹配以及短名称是长名称的前缀，但没有检查名称的长度是否相等。如果nginx配置为代理缓存的话，远程攻击者就可以通过DNS投毒攻击欺骗域名，诱骗用户相信所访问的域名为合法。 Igor Sysoev nginx 0.8.x Igor Sysoev nginx 0.7.x Igor Sysoev nginx 0.6.x Igor Sysoev nginx 0.5.x 厂商补丁： Igor Sysoev...
nginx internal DNS cache poisoning
nginx maintains an internal DNS cache for resolved domain names. However, when searching the cache, nginx only checks that the crc32 of the names match and that the shorter name is a prefix of the longer name. It does not check that the names are equal in length. One way to exploit this is if ngi...
nginx DNS cache poisoning
Invalid implementation of caching algorithm...
Fedora 11 : nginx-0.7.62-1.fc11 (2009-9630)
Mon Sep 14 2009 Jeremy Hinegardner - 0.7.62-1 - update to 0.7.62 - fixes CVE-2009-2629 - Sun Aug 2 2009 Jeremy Hinegardner - 0.7.61-1 - update to new stable 0.7.61 - remove third-party module Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...
Fedora 10 : nginx-0.7.62-1.fc10 (2009-9652)
Mon Sep 14 2009 Jeremy Hinegardner - 0.7.62-1 - update to 0.7.62 - fixes CVE-2009-2629 - Sun Aug 2 2009 Jeremy Hinegardner - 0.7.61-1 - update to new stable 0.7.61 - remove third-party module - Sat Apr 11 2009 Jeremy Hinegardner 0.6.36-1 - update to 0.6.36 - Wed Feb 25 2009 Fedora Release...
DEBIAN-CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
Immunity Canvas: NGINX
Name| nginx ---|--- CVE| CVE-2009-2629 Exploit Pack| CANVAS Description| Jinx Notes| CVE Name: CVE-2009-2629 VENDOR: nginx Notes: Use -O execshield:0 against Ubuntu targets - the default is to assume you want execshield avoidance. Repeatability: Infinite References:...
Buffer overflow
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
CVE-2009-2629
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests...
[SECURITY] Fedora 10 Update: nginx-0.7.62-1.fc10
Nginx engine x is an HTTPS server, HTTPS reverse proxy and IMAP/POP3 proxy server written by Igor Sysoev...
[SECURITY] Fedora 11 Update: nginx-0.7.62-1.fc11
Nginx engine x is an HTTPS server, HTTPS reverse proxy and IMAP/POP3 proxy server written by Igor Sysoev...
FreeBSD : nginx -- remote denial of service vulnerability (152b27f0-a158-11de-990c-e5b1d4c882e0)
nginx development team reports : A segmentation fault might occur in worker process while specially crafted request handling. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...
Debian Security Advisory DSA 1884-1 (nginx)
The remote host is missing an update to nginx announced via advisory DSA 1884-1. OpenVAS Vulnerability Test $Id: deb18841.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1884-1 nginx Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...
[SECURITY] [DSA 1884-1] New nginx packages fix arbitrary code execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1884-1 [email protected] http://www.debian.org/security/ Nico Golde September 14th, 2009 http://www.debian.org/security/faq -...