The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA88135 advisory.

  - NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file     with a modification date in 1969 that causes an integer overflow (or a false modification date far in the     future), when encountered by the autoindex module. (CVE-2017-20005)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of     service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
    (CVE-2016-0742)

  - Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows     remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other     impact via a crafted DNS response related to CNAME response processing. (CVE-2016-0746)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which     allows remote attackers to cause a denial of service (worker process resource consumption) via vectors     related to arbitrary name resolution. (CVE-2016-0747)

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-005 advisory.

    The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-22 (NGINX: Privilege escalation)

    It was discovered that Gentoo&rsquo;s default NGINX installation applied       similar problematic permissions on &ldquo;/var/log/nginx&rdquo; as Debian       (DSA-3701) and is therefore vulnerable to the same attack described in       CVE-2016-1247.
  Impact :

    A local attacker, who either is already NGINX&rsquo;s system user or belongs       to NGINX&rsquo;s group, could potentially escalate privileges.
  Workaround :

    Ensure that no untrusted user can create files in directories which are       used by NGINX (or an NGINX vhost) to store log files.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3114-1 advisory.

    Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote     attacker could possibly use this issue to obtain root privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made accessible to local users, and local users may be able to read the log files themselves local until the next logrotate invocation.

ID	Name	Product	Family	Severity
310760	Juniper Junos OS Multiple Vulnerabilities (JSA88135)	Nessus	Junos Local Security Checks	medium
219360	Linux Distros Unpatched Vulnerability : CVE-2016-1247	Nessus	Misc.	high
182010	Amazon Linux 2 : nginx (ALASNGINX1-2023-005)	Nessus	Amazon Linux Local Security Checks	high
96416	GLSA-201701-22 : NGINX: Privilege escalation	Nessus	Gentoo Local Security Checks	high
94289	Ubuntu 14.04 LTS / 16.04 LTS : nginx vulnerability (USN-3114-1)	Nessus	Ubuntu Local Security Checks	high
94260	Debian DSA-3701-1 : nginx - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-1247

high

Tenable Plugins

medium

high

high

high

high

high