FreeBSD : nginx-devel -- SPDY heap buffer overflow (da4b89ad-b28f-11e3-99ca-f0def16c5c1b)
Medium Nessus Plugin ID 73153
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionThe nginx project reports :
A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).
The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the 'spdy' option of the 'listen' directive is used in a configuration file.
The problem is fixed in nginx 1.5.12, 1.4.7.
SolutionUpdate the affected package.