nginx HTTP Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	36384
Class:	Boundary Condition Error
CVE:	CVE-2009-2629
Remote:	Yes
Local:	No
Published:	Sep 14 2009 12:00AM
Updated:	May 07 2015 05:02PM
Credit:	Chris Ries
Vulnerable:	Igor Sysoev nginx 0.8.14 Igor Sysoev nginx 0.7.61 Igor Sysoev nginx 0.6.38 Igor Sysoev nginx 0.5.37 Igor Sysoev nginx 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel
Not Vulnerable:	Igor Sysoev nginx 0.8.15 Igor Sysoev nginx 0.7.62 Igor Sysoev nginx 0.6.39 Igor Sysoev nginx 0.5.38

nginx HTTP Request Remote Buffer Overflow Vulnerability

The 'nginx' program is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

nginx HTTP Request Remote Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/36384.py

nginx HTTP Request Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 ia-32

• Debian nginx_0.4.13-2+etch2_i386.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_i386.deb

Debian Linux 5.0 hppa

• Debian nginx_0.6.32-3+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_hppa.deb

Debian Linux 5.0 ia-64

• Debian nginx_0.6.32-3+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_ia64.deb

Debian Linux 4.0 hppa

• Debian nginx_0.4.13-2+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_hppa.deb

Debian Linux 4.0 sparc

• Debian nginx_0.4.13-2+etch2_sparc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_sparc.deb

Debian Linux 4.0 s/390

• Debian nginx_0.4.13-2+etch2_s390.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_s390.deb

Debian Linux 5.0 arm

• Debian nginx_0.6.32-3+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_arm.deb

Debian Linux 4.0 powerpc

• Debian nginx_0.4.13-2+etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_powerpc.deb

Debian Linux 4.0 mipsel

• Debian nginx_0.4.13-2+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_mipsel.deb

Debian Linux 5.0 alpha

• Debian nginx_0.6.32-3+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_alpha.deb

Debian Linux 5.0 amd64

• Debian nginx_0.6.32-3+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_amd64.deb

Debian Linux 5.0 ia-32

• Debian nginx_0.6.32-3+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_i386.deb

Debian Linux 5.0 mips

• Debian nginx_0.6.32-3+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_mips.deb

Debian Linux 5.0 mipsel

• Debian nginx_0.6.32-3+lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_mipsel.deb

Debian Linux 5.0 powerpc

• Debian nginx_0.6.32-3+lenny2_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_powerpc.deb

Debian Linux 4.0 ia-64

• Debian nginx_0.4.13-2+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_ia64.deb

Debian Linux 4.0 mips

• Debian nginx_0.4.13-2+etch2_mips.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch2_mips.deb

Debian Linux 5.0 sparc

• Debian nginx_0.6.32-3+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny2_sparc.deb

nginx HTTP Request Remote Buffer Overflow Vulnerability

References:

• Changes with nginx 0.5.38 (ngnix)
  
• Changes with nginx 0.6.39 (ngnix)
  
• Changes with nginx 0.7.62 (ngnix)
  
• Changes with nginx 0.8.15 (ngnix)
  
• nginx Homepage (Igor Sysoev)
  
• Vulnerability Note VU#180065 Nginx ngx_http_parse_complex_uri() buffer underflow (US-CERT)