According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the file 'event/ngx_event_openssl.c' that could allow a remote attacker to obtain sensitive information or to take control of a session. This issue only affects servers having multiple 'server{}' configurations sharing the same values for 'ssl_session_cache' or 'ssl_session_ticket_key'.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

- Security fix for CVE-2014-3616

    - Create nginx-filesystem subpackage

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Antoine Delignat-Lavaud discovered that it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple 'server' blocks.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position.

A virtual host confusion issue was found in nginx, allowing HTTPS connections for one origin to be redirected to the virtual host of a different origin. This leads to a variety of issues, such as cookie theft and session hijacking. It could be triggered from a cross-site scripting flaw, tricking a user into visiting a malicious URL, and so on.

Updated nginx package fixes security vulnerabilities :

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position (CVE-2014-3616).

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The nginx project reports :

Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple 'server' blocks (CVE-2014-3616).

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the file 'event/ngx_event_openssl.c' that could allow a remote attacker to obtain sensitive information or to take control of a session.

Note that this issue only affects servers having multiple 'server{}' configurations sharing the same values for 'ssl_session_cache' or 'ssl_session_ticket_key'.

The remote host is affected by the vulnerability described in GLSA-201502-06 (nginx: Information disclosure)

    An SSL session fixation vulnerability has been found in nginx when       multiple servers use the same shared ssl_session_cache or       ssl_session_ticket_key.
  Impact :

    A remote attacker may be able to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
98959	Nginx < 1.7.5 SSL Session Reuse	Web App Scanning	Component Vulnerability	11/5/2018	1/3/2024	high
98960	Nginx < 1.6.2 SSL Session Reuse	Web App Scanning	Component Vulnerability	11/5/2018	1/3/2024	high
78243	Fedora 20 : nginx-1.4.7-3.fc20 (2014-11415)	Nessus	Fedora Local Security Checks	10/11/2014	1/11/2021	medium
82201	Debian DLA-55-1 : nginx security update	Nessus	Debian Local Security Checks	3/26/2015	1/11/2021	medium
77762	Debian DSA-3029-1 : nginx - security update	Nessus	Debian Local Security Checks	9/22/2014	1/11/2021	medium
77975	Fedora 21 : nginx-1.6.2-2.fc21 (2014-11251)	Nessus	Fedora Local Security Checks	9/30/2014	1/11/2021	medium
78242	Fedora 19 : nginx-1.4.7-3.fc19 (2014-11370)	Nessus	Fedora Local Security Checks	10/11/2014	1/11/2021	medium
78364	Amazon Linux AMI : nginx (ALAS-2014-421)	Nessus	Amazon Linux Local Security Checks	10/12/2014	4/18/2018	medium
82347	Mandriva Linux Security Advisory : nginx (MDVSA-2015:094)	Nessus	Mandriva Local Security Checks	3/30/2015	1/14/2021	medium
77808	Ubuntu 14.04 LTS : nginx vulnerability (USN-2351-1)	Nessus	Ubuntu Local Security Checks	9/23/2014	10/20/2023	critical
77717	FreeBSD : nginx -- inject commands into SSL session vulnerability (77b784bb-3dc6-11e4-b191-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	9/17/2014	1/6/2021	medium
78386	nginx < 1.6.2 / 1.7.5 SSL Session Reuse	Nessus	Web Servers	10/13/2014	4/11/2022	medium
81229	GLSA-201502-06 : nginx: Information disclosure	Nessus	Gentoo Local Security Checks	2/9/2015	1/11/2021	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium