nginx CVE-2013-4547 URI Processing Security Bypass Vulnerability
BID:63814
Info
nginx CVE-2013-4547 URI Processing Security Bypass Vulnerability
| Bugtraq ID: | 63814 |
| Class: | Access Validation Error |
| CVE: |
CVE-2013-4547 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2013 12:00AM |
| Updated: | May 07 2015 05:10PM |
| Credit: | Ivan Fratric of the Google Security Team |
| Vulnerable: |
Igor Sysoev nginx 1.1.17 Igor Sysoev nginx 1.0.14 Igor Sysoev nginx 1.0.10 Igor Sysoev nginx 1.0.9 Igor Sysoev nginx 1.0.8 Igor Sysoev nginx 0.8.40 Igor Sysoev nginx 1.1.19 Igor Sysoev nginx 1.0.15 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
nginx CVE-2013-4547 URI Processing Security Bypass Vulnerability
nginx is prone to a remote security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.
nginx 0.8.41 through 1.5.6 are vulnerable.
nginx is prone to a remote security-bypass vulnerability.
An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.
nginx 0.8.41 through 1.5.6 are vulnerable.
Exploit / POC
nginx CVE-2013-4547 URI Processing Security Bypass Vulnerability
An attacker can use a browser to exploit this issue.
The following example data is available:
/file \0.php
An attacker can use a browser to exploit this issue.
The following example data is available:
/file \0.php
Solution / Fix
nginx CVE-2013-4547 URI Processing Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva nginx-1.0.15-3.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/