Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.

A flaw in the custom DNS resolver of nginx could lead to a heap based buffer overflow which could potentially allow attackers to execute arbitrary code or to cause a Denial of Service (bnc#731084, CVE-2011-4315).

The remote host is affected by the vulnerability described in GLSA-201203-22 (nginx: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in nginx:
      The TLS protocol does not properly handle session renegotiation         requests (CVE-2009-3555).
      The 'ngx_http_process_request_headers()' function in ngx_http_parse.c         could cause a NULL pointer dereference (CVE-2009-3896).
      nginx does not properly sanitize user input for the the WebDAV COPY         or MOVE methods (CVE-2009-3898).
      The 'ngx_resolver_copy()' function in ngx_resolver.c contains a         boundary error which could cause a heap-based buffer overflow         (CVE-2011-4315).
      nginx does not properly parse HTTP header responses which could         expose sensitive information (CVE-2012-1180).
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the nginx process, cause a Denial of Service condition,       create or overwrite arbitrary files, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote host is running a nginx HTTP server. 

Versions earlier than 1.0.10 are vulnerable to a remote heap-based buffer-overflow vulnerability due to a failure to properly bounds check user-supplied input to the DNS resolver. The issue occurs specifically when the DNS resolver processes messages more than 255 bytes. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the application. (CVE-2011-4314)


The remote web server is running nginx, a lightweight, high performance web server / reverse proxy and email (IMAP/POP3) proxy.

According to its Server response header, the installed version of nginx is earlier than 1.0.10 and is, therefore, affected by a heap-based buffer overflow vulnerability.

An issue related to DNS response parsing exists in the function 'ngx_resolver_copy' in the file 'ngx_resolver.c' which can allow remote attackers to cause a denial of service or possibly execute arbitrary code.

Note that successful exploitation requires this application's custom DNS resolver to be enabled and that this custom resolver is not enabled by default.

fix for CVE-2011-4315 nginx: heap overflow in ngx_resolver_copy() Update to latest stable version

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75979	openSUSE Security Update : nginx-0.8 (openSUSE-SU-2012:0237-1)	Nessus	SuSE Local Security Checks	medium
74524	openSUSE Security Update : nginx-1.0 (openSUSE-2011-48)	Nessus	SuSE Local Security Checks	medium
69589	Amazon Linux AMI : nginx (ALAS-2011-30)	Nessus	Amazon Linux Local Security Checks	medium
59614	GLSA-201203-22 : nginx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
6456	nginx < 1.0.10 DNS Resolver Remote Heap Buffer Overflow	Nessus Network Monitor	Web Servers	medium
58413	nginx < 1.0.10 ngx_resolver_copy Function DNS Response Parsing Buffer Overflow	Nessus	Web Servers	medium
57007	Fedora 15 : nginx-1.0.10-1.fc15 (2011-16110)	Nessus	Fedora Local Security Checks	medium
57006	Fedora 16 : nginx-1.0.10-1.fc16 (2011-16075)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4315

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium