Vulnerabilities > CVE-2011-4315 - Out-of-bounds Write vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.

Vulnerable Configurations

Part Description Count
Application
F5
174
Application
Suse
3
OS
Fedoraproject
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_4_NGINX-0_8-111121.NASL
    descriptionA flaw in the custom DNS resolver of nginx could lead to a heap based buffer overflow which could potentially allow attackers to execute arbitrary code or to cause a Denial of Service (bnc#731084, CVE-2011-4315).
    last seen2020-06-01
    modified2020-06-02
    plugin id75979
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75979
    titleopenSUSE Security Update : nginx-0.8 (openSUSE-SU-2012:0237-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update nginx-0.8-5467.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(75979);
      script_version("1.4");
      script_cvs_date("Date: 2019/10/25 13:36:42");
    
      script_cve_id("CVE-2011-4315");
    
      script_name(english:"openSUSE Security Update : nginx-0.8 (openSUSE-SU-2012:0237-1)");
      script_summary(english:"Check for the nginx-0.8-5467 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A flaw in the custom DNS resolver of nginx could lead to a heap based
    buffer overflow which could potentially allow attackers to execute
    arbitrary code or to cause a Denial of Service (bnc#731084,
    CVE-2011-4315)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=731084"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-02/msg00040.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected nginx-0.8 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-0.8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-0.8-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-0.8-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.4");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/11/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.4)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.4", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.4", reference:"nginx-0.8-0.8.53-4.9.1") ) flag++;
    if ( rpm_check(release:"SUSE11.4", reference:"nginx-0.8-debuginfo-0.8.53-4.9.1") ) flag++;
    if ( rpm_check(release:"SUSE11.4", reference:"nginx-0.8-debugsource-0.8.53-4.9.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx-0.8 / nginx-0.8-debuginfo / nginx-0.8-debugsource");
    }
    
  • NASL familyWeb Servers
    NASL idNGINX_1_0_10.NASL
    descriptionThe remote web server is running nginx, a lightweight, high performance web server / reverse proxy and email (IMAP/POP3) proxy. According to its Server response header, the installed version of nginx is earlier than 1.0.10 and is, therefore, affected by a heap-based buffer overflow vulnerability. An issue related to DNS response parsing exists in the function
    last seen2020-05-09
    modified2012-03-21
    plugin id58413
    published2012-03-21
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58413
    titlenginx < 1.0.10 ngx_resolver_copy Function DNS Response Parsing Buffer Overflow
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include('compat.inc');
    
    if (description)
    {
      script_id(58413);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08");
    
      script_cve_id("CVE-2011-4315");
      script_bugtraq_id(50710);
    
      script_name(english:"nginx < 1.0.10 ngx_resolver_copy Function DNS Response Parsing Buffer Overflow");
    
      script_set_attribute(attribute:"synopsis", value:
    "The web server on the remote host is affected by a buffer overflow
    vulnerability.");
      script_set_attribute(attribute:"description", value:
    "The remote web server is running nginx, a lightweight, high
    performance web server / reverse proxy and email (IMAP/POP3) proxy.
    
    According to its Server response header, the installed version of
    nginx is earlier than 1.0.10 and is, therefore, affected by a
    heap-based buffer overflow vulnerability.
    
    An issue related to DNS response parsing exists in the function
    'ngx_resolver_copy' in the file 'ngx_resolver.c' which can allow
    remote attackers to cause a denial of service or possibly execute
    arbitrary code.
    
    Note that successful exploitation requires this application's custom
    DNS resolver to be enabled and that this custom resolver is not
    enabled by default.");
      script_set_attribute(attribute:"see_also", value:"http://nginx.org/en/CHANGES-1.0");
      script_set_attribute(attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2011/11/17/8");
      script_set_attribute(attribute:"see_also", value:"https://trac.nginx.org/nginx/changeset/4268/nginx");
      script_set_attribute(attribute:"solution", value:"Upgrade to version 1.0.10 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-4315");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2011/11/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/11/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/21");
    
      script_set_attribute(attribute:"cpe", value:"cpe:/a:igor_sysoev:nginx");
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"agent", value:"unix");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Web Servers");
    
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("nginx_detect.nasl", "nginx_nix_installed.nbin");
      script_require_keys("installed_sw/nginx");
    
      exit(0);
    }
    
    
    include('http.inc');
    include('vcf.inc');
    
    appname = 'nginx';
    get_install_count(app_name:appname, exit_if_zero:TRUE);
    app_info = vcf::combined_get_app_info(app:appname);
    
    vcf::check_granularity(app_info:app_info, sig_segments:3);
    
    # If the detection is only remote, Detection Method won't be set, and we should require paranoia
    if (empty_or_null(app_info['Detection Method']) && report_paranoia < 2)
      audit(AUDIT_PARANOID);
    
    
    constraints = [{'fixed_version' : '1.0.10'}];
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-16075.NASL
    descriptionfix for CVE-2011-4315 nginx: heap overflow in ngx_resolver_copy() Update to latest stable version Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id57006
    published2011-12-06
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57006
    titleFedora 16 : nginx-1.0.10-1.fc16 (2011-16075)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2011-16075.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(57006);
      script_version("1.9");
      script_cvs_date("Date: 2019/08/02 13:32:34");
    
      script_cve_id("CVE-2011-4315");
      script_bugtraq_id(50710);
      script_xref(name:"FEDORA", value:"2011-16075");
    
      script_name(english:"Fedora 16 : nginx-1.0.10-1.fc16 (2011-16075)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "fix for CVE-2011-4315 nginx: heap overflow in ngx_resolver_copy()
    Update to latest stable version
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=754757"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2011-December/070569.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?cf926d51"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected nginx package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:nginx");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:16");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/11/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^16([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 16.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC16", reference:"nginx-1.0.10-1.fc16")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-16110.NASL
    descriptionfix for CVE-2011-4315 nginx: heap overflow in ngx_resolver_copy() Update to latest stable version Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id57007
    published2011-12-06
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/57007
    titleFedora 15 : nginx-1.0.10-1.fc15 (2011-16110)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2011-16110.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(57007);
      script_version("1.9");
      script_cvs_date("Date: 2019/08/02 13:32:34");
    
      script_cve_id("CVE-2011-4315");
      script_bugtraq_id(50710);
      script_xref(name:"FEDORA", value:"2011-16110");
    
      script_name(english:"Fedora 15 : nginx-1.0.10-1.fc15 (2011-16110)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "fix for CVE-2011-4315 nginx: heap overflow in ngx_resolver_copy()
    Update to latest stable version
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=754757"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2011-December/070586.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d6d0f972"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected nginx package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:nginx");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:15");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/11/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/12/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^15([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 15.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC15", reference:"nginx-1.0.10-1.fc15")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2011-48.NASL
    descriptionA flaw in the custom DNS resolver of nginx could lead to a heap based buffer overflow which could potentially allow attackers to execute arbitrary code or to cause a Denial of Service (bnc#731084, CVE-2011-4315).
    last seen2020-06-01
    modified2020-06-02
    plugin id74524
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74524
    titleopenSUSE Security Update : nginx-1.0 (openSUSE-2011-48)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2011-48.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74524);
      script_version("1.3");
      script_cvs_date("Date: 2019/10/25 13:36:40");
    
      script_cve_id("CVE-2011-4315");
    
      script_name(english:"openSUSE Security Update : nginx-1.0 (openSUSE-2011-48)");
      script_summary(english:"Check for the openSUSE-2011-48 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A flaw in the custom DNS resolver of nginx could lead to a heap based
    buffer overflow which could potentially allow attackers to execute
    arbitrary code or to cause a Denial of Service (bnc#731084,
    CVE-2011-4315)."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected nginx-1.0 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-1.0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-1.0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nginx-1.0-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/12/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"nginx-1.0-1.0.10-3.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"nginx-1.0-debuginfo-1.0.10-3.4.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"nginx-1.0-debugsource-1.0.10-3.4.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx-1.0 / nginx-1.0-debuginfo / nginx-1.0-debugsource");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2011-30.NASL
    descriptionHeap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
    last seen2020-06-01
    modified2020-06-02
    plugin id69589
    published2013-09-04
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69589
    titleAmazon Linux AMI : nginx (ALAS-2011-30)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2011-30.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69589);
      script_version("1.5");
      script_cvs_date("Date: 2018/04/18 15:09:34");
    
      script_cve_id("CVE-2011-4315");
      script_xref(name:"ALAS", value:"2011-30");
    
      script_name(english:"Amazon Linux AMI : nginx (ALAS-2011-30)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Heap-based buffer overflow in compression-pointer processing in
    core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to
    cause a denial of service (daemon crash) or possibly have unspecified
    other impact via a long response."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2011-30.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update nginx' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nginx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:nginx-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2011/12/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"nginx-0.8.54-1.4.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"nginx-debuginfo-0.8.54-1.4.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx / nginx-debuginfo");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201203-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201203-22 (nginx: Multiple vulnerabilities) Multiple vulnerabilities have been found in nginx: The TLS protocol does not properly handle session renegotiation requests (CVE-2009-3555). The
    last seen2020-06-01
    modified2020-06-02
    plugin id59614
    published2012-06-21
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59614
    titleGLSA-201203-22 : nginx: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201203-22.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59614);
      script_version("1.8");
      script_cvs_date("Date: 2018/07/11 17:09:26");
    
      script_cve_id("CVE-2009-3555", "CVE-2009-3896", "CVE-2009-3898", "CVE-2011-4315", "CVE-2012-1180");
      script_bugtraq_id(36490, 36839, 36935, 50710, 52578);
      script_xref(name:"GLSA", value:"201203-22");
    
      script_name(english:"GLSA-201203-22 : nginx: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201203-22
    (nginx: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been found in nginx:
          The TLS protocol does not properly handle session renegotiation
            requests (CVE-2009-3555).
          The 'ngx_http_process_request_headers()' function in ngx_http_parse.c
            could cause a NULL pointer dereference (CVE-2009-3896).
          nginx does not properly sanitize user input for the the WebDAV COPY
            or MOVE methods (CVE-2009-3898).
          The 'ngx_resolver_copy()' function in ngx_resolver.c contains a
            boundary error which could cause a heap-based buffer overflow
            (CVE-2011-4315).
          nginx does not properly parse HTTP header responses which could
            expose sensitive information (CVE-2012-1180).
      
    Impact :
    
        A remote attacker could possibly execute arbitrary code with the
          privileges of the nginx process, cause a Denial of Service condition,
          create or overwrite arbitrary files, or obtain sensitive information.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201203-22"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All nginx users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-servers/nginx-1.0.14'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(22, 119, 310);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:nginx");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/03/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-servers/nginx", unaffected:make_list("ge 1.0.14"), vulnerable:make_list("lt 1.0.14"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx");
    }
    

Seebug

bulletinFamilyexploit
descriptionBugtraq ID: 50710 CVE ID:CVE-2011-4315 nginx是一款高性能的web服务器,使用非常广泛,其不仅经常被用作反向代理,也可以非常好的支持PHP的运行。 当处理DNS应答时&quot;ngx_resolver_copy()&quot;函数(ngx_resolver.c)存在边界错误,构建特制DNS应答可触发基于堆的缓冲区溢出。 DNS解析器一般用于代理和fastcgi模块,默认不启用。 Igor Sysoev nginx 1.0.9 Igor Sysoev nginx 1.0.8 Igor Sysoev nginx 0.8.40 Igor Sysoev nginx 0.8.36 Igor Sysoev nginx 0.8.35 Igor Sysoev nginx 0.8.33 Igor Sysoev nginx 0.8.32 Igor Sysoev nginx 0.8.15 Igor Sysoev nginx 0.8.14 Igor Sysoev nginx 0.7.66 Igor Sysoev nginx 0.7.65 Igor Sysoev nginx 0.7.64 Igor Sysoev nginx 0.7.62 Igor Sysoev nginx 0.7.61 Igor Sysoev nginx 0.7 Igor Sysoev nginx 0.6.39 Igor Sysoev nginx 0.6.38 Igor Sysoev nginx 0.6.36 Igor Sysoev nginx 0.6.32 Igor Sysoev nginx 0.6 Igor Sysoev nginx 0.5.38 Igor Sysoev nginx 0.5.37 Igor Sysoev nginx 0.5 厂商解决方案 Igor Sysoev nginx 1.0.10已经修复此漏洞,建议用户下载使用: http://nginx.org/
idSSV:23216
last seen2017-11-19
modified2011-11-18
published2011-11-18
reporterRoot
titlenginx DNS解析器远程堆缓冲区溢出漏洞