Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.

According to the self-reported version in the server response header, the installed 1.3.x version of nginx is 1.3.15 or higher, or 1.4.x prior to 1.4.7, or 1.5.x prior to 1.5.12. It is, therefore, affected by a heap buffer overflow vulnerability.

A flaw exists with the SPDY protocol implementation where user input is not properly validated. This could allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service or potential arbitrary code execution.

Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated nginx package fixes security vulnerabilities :

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position (CVE-2014-3616).

The remote host is affected by the vulnerability described in GLSA-201406-20 (nginx: Arbitrary code execution)

    A bug in the SPDY implementation in nginx was found which might cause a       heap memory buffer overflow in a worker process by using a specially       crafted request. The SPDY implementation is not enabled in default       configurations.
  Impact :

    A remote attacker could cause execution of arbitrary code by using a       specially crafted request.
  Workaround :

    Disable the spdy module in NGINX_MODULES_HTTP.

nginx was updated to 1.4.7 to fix bugs and security issues.

Fixed security issues :

  - CVE-2014-0133: nginx:heap-based buffer overflow in SPDY     implementation

New upstream release 1.4.7 (bnc#869076) (CVE-2014-0133)

*) Security: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_spdy_module, potentially resulting in arbitrary code execution (CVE-2014-0133). Thanks to Lucas Molas, researcher at Programa STIC, Fundaci&oacute;n Dr. Manuel Sadosky, Buenos Aires, Argentina.

*) Bugfix: in the 'fastcgi_next_upstream' directive. Thanks to Lucas Molas.

*) Bugfix: the 'client_max_body_size' directive might not work when reading a request body using chunked transfer encoding; the bug had appeared in 1.3.9. Thanks to Lucas Molas.

*) Bugfix: a segmentation fault might occur in a worker process when proxying WebSocket connections.

*) Bugfix: the $ssl_session_id variable contained full session serialized instead of just a session id. Thanks to Ivan Risti&#x107;.

*) Bugfix: client connections might be immediately closed if deferred accept was used; the bug had appeared in 1.3.15.

*) Bugfix: alerts 'zero size buf in output' might appear in logs while proxying; the bug had appeared in 1.3.9.

*) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_spdy_module was used.

*) Bugfix: proxied WebSocket connections might hang right after handshake if the select, poll, or /dev/poll methods were used.

*) Bugfix: a timeout might occur while reading client request body in an SSL connection using chunked transfer encoding.

*) Bugfix: memory leak in nginx/Windows.

According to the self-reported version in the server response header, the installed 1.3.x version of nginx is 1.3.15 or higher, or 1.4.x prior to 1.4.7, or 1.5.x prior to 1.5.12. It is, therefore, affected by a heap buffer overflow vulnerability.

A flaw exists with the SPDY protocol implementation where user input is not properly validated. This could allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service or potential arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The nginx project reports :

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the 'spdy' option of the 'listen' directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

ID	Name	Product	Family	Severity
98956	Nginx < 1.4.7 SPDY Heap Buffer Overflow	Web App Scanning	Component Vulnerability	critical
98955	Nginx < 1.5.12 SPDY Heap Buffer Overflow	Web App Scanning	Component Vulnerability	critical
82347	Mandriva Linux Security Advisory : nginx (MDVSA-2015:094)	Nessus	Mandriva Local Security Checks	medium
76179	GLSA-201406-20 : nginx: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
75309	openSUSE Security Update : nginx (openSUSE-SU-2014:0450-1)	Nessus	SuSE Local Security Checks	medium
73519	nginx < 1.4.7 / 1.5.12 SPDY Heap Buffer Overflow	Nessus	Web Servers	medium
73227	Amazon Linux AMI : nginx (ALAS-2014-308)	Nessus	Amazon Linux Local Security Checks	medium
73154	FreeBSD : nginx -- SPDY heap buffer overflow (fc28df92-b233-11e3-99ca-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	medium
73153	FreeBSD : nginx-devel -- SPDY heap buffer overflow (da4b89ad-b28f-11e3-99ca-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-0133

critical

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium