Detections
Analytics
nginx < 1.6.1 / 1.7.4 SMTP STARTTLS Command Injection
medium Nessus Plugin ID 77246
Language:
Synopsis
The remote web server is affected by a command injection vulnerability.Description
The version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability.A flaw exists in the function 'ngx_mail_smtp_starttls' within the file 'src/mail/ngx_mail_smtp_handler.c' whereby input to the STARTTLS command is not properly sanitized. This could allow a remote attacker in a privileged network position to obtain sensitive information by injecting commands into an SSL session.
Note that this issue is exploitable only when nginx is used as an SMTP proxy.
Solution
Apply the patch manually, or upgrade to nginx 1.6.1 / 1.7.4 or later.See Also
http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html
http://nginx.org/download/patch.2014.starttls.txt
Plugin Details
Severity: Medium
ID: 77246
File Name: nginx_1_7_4.nasl
Version: 1.14
Type: Combined
Agent: unix
Family: Web Servers
Published: 8/19/2014
Updated: 7/17/2026
Configuration: Enable paranoid mode, Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.99
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2014-3556
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:nginx:nginx
Required KB Items: Settings/ParanoidReport, installed_sw/nginx
Exploit Ease: No known exploits are available
Patch Publication Date: 8/5/2014
Vulnerability Publication Date: 8/5/2014
Reference Information
CVE: CVE-2014-3556
BID: 69111