Detections
Analytics

nginx < 1.6.2 / 1.7.5 SSL Session Reuse

medium Nessus Plugin ID 78386

Language:

Synopsis

The remote web server is affected by an SSL session handling vulnerability.

Description

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the file 'event/ngx_event_openssl.c' that could allow a remote attacker to obtain sensitive information or to take control of a session.

Note that this issue only affects servers having multiple 'server{}' configurations sharing the same values for 'ssl_session_cache' or 'ssl_session_ticket_key'.

Solution

Upgrade to nginx 1.6.2 / 1.7.5 or later.

See Also

http://bh.ht.vc/vhost_confusion.pdf

http://nginx.org/en/security_advisories.html

http://mailman.nginx.org/pipermail/nginx-announce/2014/000146.html

http://mailman.nginx.org/pipermail/nginx-announce/2014/000145.html

http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html

http://nginx.org/en/CHANGES

http://nginx.org/en/CHANGES-1.6

Plugin Details

Severity: Medium

ID: 78386

File Name: nginx_1_7_5.nasl

Version: 1.14

Type: combined

Agent: unix

Family: Web Servers

Published: 10/13/2014

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: The nvd score does not account for the potential for the virtual host confusion attack being used to access confidential data (as detailed in the original virtual host confusion: weaknesses and exploits blackhat 2014 paper from antoine delignat-lavaud)

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: manual

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nginx:nginx

Required KB Items: installed_sw/nginx

Exploit Ease: No known exploits are available

Patch Publication Date: 9/16/2014

Vulnerability Publication Date: 8/6/2014

Reference Information

CVE: CVE-2014-3616

BID: 70025