nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability

Bugtraq ID:	36839
Class:	Boundary Condition Error
CVE:	CVE-2009-3896
Remote:	Yes
Local:	No
Published:	Oct 27 2009 12:00AM
Updated:	Apr 13 2015 08:25PM
Credit:	Jasson Bell
Vulnerable:	Igor Sysoev nginx 0.7.61 Igor Sysoev nginx 0.7 Igor Sysoev nginx 0.6.38 Igor Sysoev nginx 0.6.32 Igor Sysoev nginx 0.6 Igor Sysoev nginx 0.5.37 Igor Sysoev nginx 0.5 Igor Sysoev nginx 0.4.14 Igor Sysoev nginx 0.4.13 Igor Sysoev nginx 0.4 Igor Sysoev nginx 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability

The 'nginx' program is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/36839.pl

nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for details.


Debian Linux 4.0 arm

• Debian nginx_0.4.13-2+etch3_arm.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_arm.deb

Debian Linux 5.0 ia-64

• Debian nginx_0.6.32-3+lenny3_ia64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_ia64.deb

Debian Linux 4.0 powerpc

• Debian nginx_0.4.13-2+etch3_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_powerpc.deb

Debian Linux 5.0 alpha

• Debian nginx_0.6.32-3+lenny3_alpha.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_alpha.deb

Debian Linux 5.0 ia-32

• Debian nginx_0.6.32-3+lenny3_i386.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_i386.deb

Debian Linux 5.0 s/390

• Debian nginx_0.6.32-3+lenny3_s390.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_s390.deb

Debian Linux 5.0 mipsel

• Debian nginx_0.6.32-3+lenny3_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_mipsel.deb

Debian Linux 4.0 amd64

• Debian nginx_0.4.13-2+etch3_amd64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_amd64.deb

Debian Linux 4.0 ia-32

• Debian nginx_0.4.13-2+etch3_i386.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_i386.deb

Debian Linux 5.0 hppa

• Debian nginx_0.6.32-3+lenny3_hppa.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_hppa.deb

Debian Linux 4.0 hppa

• Debian nginx_0.4.13-2+etch3_hppa.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_hppa.deb

Debian Linux 4.0 sparc

• Debian nginx_0.4.13-2+etch3_sparc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_sparc.deb

Debian Linux 4.0 s/390

• Debian nginx_0.4.13-2+etch3_s390.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_s390.deb

Debian Linux 5.0 arm

• Debian nginx_0.6.32-3+lenny3_arm.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_arm.deb

Debian Linux 4.0 alpha

• Debian nginx_0.4.13-2+etch3_alpha.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_alpha.deb

Debian Linux 5.0 armel

• Debian nginx_0.6.32-3+lenny3_armel.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_armel.deb

Debian Linux 5.0 amd64

• Debian nginx_0.6.32-3+lenny3_amd64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_amd64.deb

Debian Linux 4.0 mipsel

• Debian nginx_0.4.13-2+etch3_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_mipsel.deb

Debian Linux 5.0 mips

• Debian nginx_0.6.32-3+lenny3_mips.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_mips.deb

Debian Linux 5.0 powerpc

• Debian nginx_0.6.32-3+lenny3_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_powerpc.deb

Debian Linux 4.0 ia-64

• Debian nginx_0.4.13-2+etch3_ia64.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_ia64.deb

Debian Linux 4.0 mips

• Debian nginx_0.4.13-2+etch3_mips.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+et ch3_mips.deb

Debian Linux 5.0 sparc

• Debian nginx_0.6.32-3+lenny3_sparc.deb
  http://security.debian.org/pool/updates/main/n/nginx/nginx_0.6.32-3+le nny3_sparc.deb

nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability

References:

• nginx Homepage (Igor Sysoev)
  
• there is null pointer dereference in nginx in debian etch/lenny (Jasson Bell)