The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA88135 advisory.

  - NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file     with a modification date in 1969 that causes an integer overflow (or a false modification date far in the     future), when encountered by the autoindex module. (CVE-2017-20005)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of     service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
    (CVE-2016-0742)

  - Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows     remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other     impact via a crafted DNS response related to CNAME response processing. (CVE-2016-0746)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which     allows remote attackers to cause a denial of service (worker process resource consumption) via vectors     related to arbitrary name resolution. (CVE-2016-0747)

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of
    service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
    (CVE-2016-0742)

  - Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows
    remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other
    impact via a crafted DNS response related to CNAME response processing. (CVE-2016-0746)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which
    allows remote attackers to cause a denial of service (worker process resource consumption) via vectors
    related to arbitrary name resolution. (CVE-2016-0747)

According to the self-reported version in its response header, the version of nginx hosted on the remote web server is less than 1.8.1 or 1.9.x prior to 1.9.10. It is, therefore, affected by multiple vulnerabilities as noted in the vendor advisory.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nginx hosted on the remote web server is less than 1.8.1 or 1.9.x prior to 1.9.10. It is, therefore, affected by multiple vulnerabilities as noted in the vendor advisory.

The remote host is affected by the vulnerability described in GLSA-201606-06 (nginx: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in nginx. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a crafted packet.
  Workaround :

    There is no known workaround at this time.

It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)

A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746)

It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747)

Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the 'resolver' directive is used in a configuration file.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2892-1 advisory.

    It was discovered that nginx incorrectly handled certain DNS server responses when the resolver is     enabled. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of     service. (CVE-2016-0742)

    It was discovered that nginx incorrectly handled CNAME response processing when the resolver is enabled. A     remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-0746)

    It was discovered that nginx incorrectly handled CNAME resolution when the resolver is enabled. A remote     attacker could possibly use this issue to cause nginx to consume resources, resulting in a denial of     service. (CVE-2016-0747)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to nginx 1.8.1 fixes the following issues :

  - CVE-2016-0742: Invalid pointer dereference during DNS     server response processing (boo#963781)

  - CVE-2016-0746: Use-after-free condition during CNAME     response processing (boo#963778)

  - CVE-2016-0747: Resource exhaustion through unlimited     CNAME resolution (boo#963775)

Maxim Dounin reports :

Several problems in nginx resolver were identified, which might allow an attacker to cause worker process crash, or might have potential other impact if the 'resolver' directive is used in a configuration file.

It was discovered that there was a invalid pointer deference in nginx, a small, powerful, scalable web/proxy server. An invalid pointer dereference might occur during DNS server response processing, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process crash

For Debian 6 Squeeze, this issue has been fixed in nginx version 0.7.67-3+squeeze4+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
310760	Juniper Junos OS Multiple Vulnerabilities (JSA88135)	Nessus	Junos Local Security Checks	Combined	medium
401061	Alpine: multiple nginx packages: security update to 1.8.0-r3 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401061	Alpine: multiple nginx packages: security update to 1.8.0-r3 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
98963	Nginx < 1.8.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98962	Nginx < 1.9.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
107265	nginx < 1.8.1 / 1.9.x < 1.9.10 Multiple Vulnerabilities	Nessus	Web Servers	Combined	critical
103587	GLSA-201606-06 : nginx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
89120	Amazon Linux AMI : nginx (ALAS-2016-655)	Nessus	Amazon Linux Local Security Checks	Local	high
88702	Debian DSA-3473-1 : nginx - security update	Nessus	Debian Local Security Checks	Local	high
88678	Ubuntu 14.04 LTS : nginx vulnerabilities (USN-2892-1)	Nessus	Ubuntu Local Security Checks	Local	critical
88614	openSUSE Security Update : nginx (openSUSE-2016-161)	Nessus	SuSE Local Security Checks	Local	high
88503	FreeBSD : nginx -- multiple vulnerabilities (c1c18ee1-c711-11e5-96d6-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	Local	high
88422	Debian DLA-404-1 : nginx security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-0742

high

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

high

high

critical

high

high

medium