Detections
Analytics
nginx ngx_http_proxy_module.c Memory Disclosure
medium Nessus Plugin ID 66671
Language:
Synopsis
The remote web server is affected by a remote memory disclosure vulnerability.Description
The installed version of nginx is 1.1.x, greater than or equal to 1.1.4, or 1.2.x prior to 1.2.9. It is, therefore, affected by a memory disclosure vulnerability in 'ngx_http_proxy_module.c' when 'proxy_pass' to untrusted upstream servers is used.By sending a specially crafted request, an attacker may be able to gain access to worker process memory or trigger a denial of service condition.
Solution
Either apply the patch manually or upgrade to nginx 1.2.9 or later.See Also
http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html
Plugin Details
Severity: Medium
ID: 66671
File Name: nginx_1_2_9.nasl
Version: 1.17
Type: Combined
Agent: unix
Family: Web Servers
Published: 5/29/2013
Updated: 7/17/2026
Configuration: Enable paranoid mode, Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P
CVSS Score Source: CVE-2013-2070
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:nginx:nginx
Required KB Items: Settings/ParanoidReport, installed_sw/nginx
Exploit Ease: No known exploits are available
Patch Publication Date: 5/13/2013
Vulnerability Publication Date: 5/13/2013
Reference Information
CVE: CVE-2013-2070
BID: 59824