Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.

specially crafted http responses from upstream server could leak already freed memory

The remote host is affected by the vulnerability described in GLSA-201203-22 (nginx: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in nginx:
      The TLS protocol does not properly handle session renegotiation         requests (CVE-2009-3555).
      The 'ngx_http_process_request_headers()' function in ngx_http_parse.c         could cause a NULL pointer dereference (CVE-2009-3896).
      nginx does not properly sanitize user input for the the WebDAV COPY         or MOVE methods (CVE-2009-3898).
      The 'ngx_resolver_copy()' function in ngx_resolver.c contains a         boundary error which could cause a heap-based buffer overflow         (CVE-2011-4315).
      nginx does not properly parse HTTP header responses which could         expose sensitive information (CVE-2012-1180).
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the nginx process, cause a Denial of Service condition,       create or overwrite arbitrary files, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote host is running a nginx HTTP server. 

 Versions earlier than 1.0.14(stable version) or versions earlier than 1.1.17(development version) are vulnerable to an information-disclosure vulnerability, when handling specially crafted HTTP responses. Attackers can exploit this issue to disclose the content of the previously freed memory. (CVE-2012-1180)


Update to upstream release 1.0.14 to fix: malformed HTTP response headers leads to information leak.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in nginx :

Specially crafted backend response could result in sensitive information leak (CVE-2012-1180).

The updated packages have been patched to correct this issue.

The remote web server is running nginx, a lightweight, high performance web server / reverse proxy and email (IMAP/POP3) proxy.

According to its Server response header, the installed version of nginx is earlier than 1.0.14 or is 1.1.x before 1.1.17 and is, therefore, affected by a memory disclosure vulnerability.

An issue related to the parsing of HTTP header responses can allow a remote attacker to obtain the contents of previously freed memory.

Matthew Daley discovered a memory disclosure vulnerability in nginx.
In previous versions of this web server, an attacker can receive the content of previously freed memory if an upstream server returned a specially crafted HTTP response, potentially exposing sensitive information.

ID	Name	Product	Family	Severity
74588	openSUSE Security Update : nginx-1.0 (openSUSE-SU-2012:0469-1)	Nessus	SuSE Local Security Checks	medium
69670	Amazon Linux AMI : nginx (ALAS-2012-63)	Nessus	Amazon Linux Local Security Checks	medium
59614	GLSA-201203-22 : nginx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
6457	nginx < 1.0.14 / 1.1.x < 1.1.17 Information-Disclosure	Nessus Network Monitor	Web Servers	medium
58688	Fedora 17 : nginx-1.0.14-1.fc17 (2012-3846)	Nessus	Fedora Local Security Checks	medium
58546	Fedora 15 : nginx-1.0.14-1.fc15 (2012-4006)	Nessus	Fedora Local Security Checks	medium
58545	Fedora 16 : nginx-1.0.14-1.fc16 (2012-3991)	Nessus	Fedora Local Security Checks	medium
58522	Mandriva Linux Security Advisory : nginx (MDVSA-2012:043)	Nessus	Mandriva Local Security Checks	medium
58414	nginx < 1.0.14 / 1.1.17 HTTP Header Response Memory Disclosure	Nessus	Web Servers	medium
58391	Debian DSA-2434-1 : nginx - sensitive information leak	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1180

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium