Vulnerabilities > CVE-2018-1000168 - NULL Pointer Dereference vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Misc. NASL id NODEJS_2018_JUL.NASL description The version of Node.js installed on the remote host is 6.x prior to 6.14.3, 8.x prior to 8.11.3, 9.x prior to 9.11.2 or 10.x prior to 10.4.1. It, therefore, is affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 118957 published 2018-11-14 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118957 title Node.js multiple vulnerabilities (July 2018 Security Releases). code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(118957); script_version("1.3"); script_cvs_date("Date: 2019/11/04"); script_cve_id( "CVE-2018-7161", "CVE-2018-7162", "CVE-2018-7164", "CVE-2018-7167", "CVE-2018-1000168" ); script_bugtraq_id(103952, 104463, 104468); script_name(english:"Node.js multiple vulnerabilities (July 2018 Security Releases)."); script_summary(english:"Checks the Node.js version."); script_set_attribute(attribute:"synopsis", value: "Node.js - JavaScript run-time environment is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Node.js installed on the remote host is 6.x prior to 6.14.3, 8.x prior to 8.11.3, 9.x prior to 9.11.2 or 10.x prior to 10.4.1. It, therefore, is affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); # https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a072ed2c"); script_set_attribute(attribute:"solution", value: "Upgrade Node.js to a recommended by vendor version or above"); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-7162"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"agent", value:"all"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2018/06/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/14"); script_set_attribute(attribute:"potential_vulnerability", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("os_fingerprint.nasl", "nodejs_win_installed.nbin"); script_require_keys("Settings/ParanoidReport"); script_require_ports("installed_sw/Node.js"); exit(0); } include("vcf.inc"); if (report_paranoia < 2) audit(AUDIT_PARANOID); win_local = FALSE; os = get_kb_item_or_exit("Host/OS"); if ("windows" >< tolower(os)) win_local = TRUE; app_info = vcf::get_app_info(app:"Node.js", win_local:win_local); vcf::check_granularity(app_info:app_info, sig_segments:3); constraints = [ { "min_version" : "6.0.0", "fixed_version" : "6.14.3" }, { "min_version" : "8.0.0", "fixed_version" : "8.11.3" }, { "min_version" : "9.0.0", "fixed_version" : "9.11.2" }, { "min_version" : "10.0.0", "fixed_version" : "10.4.1" } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-724.NASL description This update for nodejs8 to version 8.11.3 fixes the following issues : These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-05 modified 2018-07-16 plugin id 111095 published 2018-07-16 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111095 title openSUSE Security Update : nodejs8 (openSUSE-2018-724) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2018-724. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(111095); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2018-1000168", "CVE-2018-7161", "CVE-2018-7167"); script_name(english:"openSUSE Security Update : nodejs8 (openSUSE-2018-724)"); script_summary(english:"Check for the openSUSE-2018-724 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for nodejs8 to version 8.11.3 fixes the following issues : These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) This update was imported from the SUSE:SLE-15:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1091764" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1097375" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1097401" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1097404" ); script_set_attribute( attribute:"solution", value:"Update the affected nodejs8 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nodejs8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nodejs8-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nodejs8-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:nodejs8-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:npm8"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0"); script_set_attribute(attribute:"patch_publication_date", value:"2018/07/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/16"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE15.0", reference:"nodejs8-8.11.3-lp150.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"nodejs8-debuginfo-8.11.3-lp150.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"nodejs8-debugsource-8.11.3-lp150.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"nodejs8-devel-8.11.3-lp150.2.3.1") ) flag++; if ( rpm_check(release:"SUSE15.0", reference:"npm8-8.11.3-lp150.2.3.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nodejs8 / nodejs8-debuginfo / nodejs8-debugsource / nodejs8-devel / etc"); }
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_1FCCB25E8451438CA2B96A021E4D7A31.NASL description nghttp2 blog : If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. ALTSVC frame is defined by RFC 7838. The largest frame size libnghttp2 accept is by default 16384 bytes. Receiving ALTSVC frame is disabled by default. Application has to enable it explicitly by calling nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC). Transmission of ALTSVC is always enabled, and it does not cause this vulnerability. ALTSVC frame is expected to be sent by server, and received by client as defined in RFC 7838. Client and server are both affected by this vulnerability if the reception of ALTSVC frame is enabled. As written earlier, it is useless to enable reception of ALTSVC frame on server side. So, server is generally safe unless application accidentally enabled the reception of ALTSVC frame. last seen 2020-06-01 modified 2020-06-02 plugin id 109050 published 2018-04-16 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109050 title FreeBSD : nghttp2 -- Denial of service due to NULL pointer dereference (1fccb25e-8451-438c-a2b9-6a021e4d7a31) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-0367.NASL description An update is now available for JBoss Core Services on RHEL 6 and RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked to in the References section. Security Fixes : * httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763) * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312) * httpd: Out of bound access after failure in reading the HTTP request (CVE-2018-1301) * httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302) * httpd: bypass with a trailing newline in the file name (CVE-2017-15715) * httpd: Out of bound write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710) * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause a denial of service (CVE-2018-1303) * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications (CVE-2018-1283) * httpd: mod_http2: too much time allocated to workers, possibly leading to DoS (CVE-2018-1333) * mod_jk: connector path traversal due to mishandled HTTP requests in httpd (CVE-2018-11759) * nghttp2: NULL pointer dereference when too large ALTSVC frame is received (CVE-2018-1000168) * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739) Details around each issue, including information about the CVE, severity of the issue, and the CVSS score, can be found on the CVE pages listed in the Reference section below. last seen 2020-06-01 modified 2020-06-02 plugin id 122292 published 2019-02-19 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122292 title RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_45B8E2EB705611E88FAB63CA6E0E13A2.NASL description Node.js reports : Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161) All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue. Denial of Service, nghttp2 dependency (CVE-2018-1000168) All versions of 9.x and later are vulnerable and the severity is HIGH. Under certain conditions, a malicious client can trigger an uninitialized read (and a subsequent segfault) by sending a malformed ALTSVC frame. This has been addressed through an by updating nghttp2. Denial of Service Vulnerability in TLS (CVE-2018-7162) All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team. Memory exhaustion DoS on v9.x (CVE-2018-7164) Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour. Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167) Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. last seen 2020-06-01 modified 2020-06-02 plugin id 110539 published 2018-06-15 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110539 title FreeBSD : node.js -- multiple vulnerabilities (45b8e2eb-7056-11e8-8fab-63ca6e0e13a2) NASL family SuSE Local Security Checks NASL id SUSE_SU-2018-1918-1.NASL description This update for nodejs8 to version 8.11.3 fixes the following issues: These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-21 modified 2019-01-02 plugin id 120038 published 2019-01-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120038 title SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2018:1918-1) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2018-1_0-0150.NASL description An update of {'gcc', 'nghttp2'} packages of Photon OS has been released. last seen 2019-02-21 modified 2019-02-07 plugin id 111276 published 2018-07-24 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=111276 title Photon OS 1.0 : gcc / nghttp2 (PhotonOS-PHSA-2018-1.0-0150 (deprecated) NASL family Fedora Local Security Checks NASL id FEDORA_2018-CEC96A9C41.NASL description - update to the latest upstream release (fixes CVE-2018-1000168) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-04-23 plugin id 109226 published 2018-04-23 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109226 title Fedora 27 : nghttp2 (2018-cec96a9c41) NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2018-1020.NASL description nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1. (CVE-2018-1000168) last seen 2020-06-01 modified 2020-06-02 plugin id 110193 published 2018-05-30 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110193 title Amazon Linux 2 : nghttp2 (ALAS-2018-1020) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-513.NASL description This update for nodejs8 to version 8.11.3 fixes the following issues : These security issues were fixed : - CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). - CVE-2018-7161: By interacting with the http2 server in a manner that triggered a cleanup bug where objects are used in native code after they are no longer available an attacker could have caused a denial of service (DoS) by causing a node server providing an http2 server to crash (bsc#1097404). - CVE-2018-1000168: Fixed a denial of service vulnerability by unbundling nghttp2 (bsc#1097401) This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 123217 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123217 title openSUSE Security Update : nodejs8 (openSUSE-2019-513) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2018-1_0-0150_NGHTTP2.NASL description An update of the nghttp2 package has been released. last seen 2020-03-17 modified 2019-02-07 plugin id 121850 published 2019-02-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/121850 title Photon OS 1.0: Nghttp2 PHSA-2018-1.0-0150 NASL family Fedora Local Security Checks NASL id FEDORA_2018-BDEFA5E5BB.NASL description - update to the latest upstream release (fixes CVE-2018-1000168) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120750 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120750 title Fedora 28 : nghttp2 (2018-bdefa5e5bb)
Redhat
advisories |
| ||||||||
rpms |
|
References
- http://www.securityfocus.com/bid/103952
- http://www.securityfocus.com/bid/103952
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0367
- https://access.redhat.com/errata/RHSA-2019:0367
- https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
- https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
- https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
- https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/