Detections
Analytics
nginx R8 < R18-P1 Multiple Vulnerabilities
high Nessus Plugin ID 161697
Language:
Synopsis
The remote web server is affected by multiple denial of service vulnerabilities.Description
According to it's self reported version, the installed version of Nginx Plus is R8 (built on Open Source version 1.9.9) prior to R18-P1 (built on Open Source version 1.15.10). It is, therefore, affected by multiple denial of service vulnerabilities :- A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional conditions. An unauthenticated, remote attacker can exploit this, by manipulating the window size and stream priority of a large data request, to cause a denial of service condition. (CVE-2019-9511)
- A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional conditions. An unauthenticated, remote attacker can exploit this, by creating multiple request streams and continually shuffling the priority of the streams, to cause a denial of service condition. (CVE-2019-9513)
- A denial of service vulnerability exists in the HTTP/2 protocol stack due to improper handling of exceptional conditions. An unauthenticated, remote attacker can exploit this, by sending a stream of headers with a zero length header name and zero length header value, to cause a denial of service condition. (CVE-2019-9516)
Solution
Upgrade to Nginx Plus version R18-P1 or later.See Also
https://docs.nginx.com/nginx/releases/
http://www.nessus.org/u?b562be58
Plugin Details
Severity: High
ID: 161697
File Name: nginx_plus_r18p1.nasl
Version: 1.3
Type: local
Agent: unix
Family: Web Servers
Published: 5/31/2022
Updated: 10/26/2023
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2019-9513
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:nginx:nginx
Required KB Items: installed_sw/nginx
Exploit Ease: No known exploits are available
Patch Publication Date: 8/13/2019
Vulnerability Publication Date: 8/13/2019