Sign-up

ID

VAR-201403-0548


CVE

CVE-2014-0133


TITLE

nginx of SPDY Implementation of heap-based buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-001833

DESCRIPTION

Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. nginx is prone to a heap-based buffer-overflow vulnerability. Successful exploitation of this issue allow an attacker to execute arbitrary code in the context of the application, failed exploit attempts may lead to denial-of-service. nginx 1.3.15 through 1.4.7 and 1.5.0 through 1.5.12 are vulnerable. nginx is a lightweight web server/reverse proxy server and email (IMAP/POP3) proxy server developed by Russian programmer Igor Sysoev. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201406-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nginx: Arbitrary code execution Date: June 22, 2014 Bugs: #505018 ID: 201406-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been found in nginx which may allow execution of arbitrary code. Background ========== nginx is a robust, small, and high performance HTTP and reverse proxy server. The SPDY implementation is not enabled in default configurations. Workaround ========== Disable the spdy module in NGINX_MODULES_HTTP. Resolution ========== All nginx users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.4.7" References ========== [ 1 ] CVE-2014-0133 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0133 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201406-20.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position (CVE-2014-3616). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616 http://advisories.mageia.org/MGASA-2014-0136.html http://advisories.mageia.org/MGASA-2014-0427.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 2/X86_64: f859044a48eda0b859c931bce3688184 mbs2/x86_64/nginx-1.4.7-1.mbs2.x86_64.rpm 36f49f7a1ca40c8546e82d514023b3f4 mbs2/SRPMS/nginx-1.4.7-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVFnUlmqjQ0CJFipgRAvneAJ0evtNmMhS+lWltq9051wHRR6vuDgCg3BW0 x8jC+tKifZWs8shTG2EYzgo= =oIRY -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2014-0133 // JVNDB: JVNDB-2014-001833 // BID: 66537 // VULHUB: VHN-67626 // PACKETSTORM: 127175 // PACKETSTORM: 131099

AFFECTED PRODUCTS

vendor:novellmodel:opensusescope:eqversion:13.1

Trust: 1.4

vendor:f5model:nginxscope:gteversion:1.5.0

Trust: 1.0

vendor:f5model:nginxscope:ltversion:1.4.7

Trust: 1.0

vendor:f5model:nginxscope:gteversion:1.3.15

Trust: 1.0

vendor:opensusemodel:opensusescope:eqversion:13.1

Trust: 1.0

vendor:f5model:nginxscope:lteversion:1.5.11

Trust: 1.0

vendor:igor sysoevmodel:nginxscope:ltversion:1.3.15

Trust: 0.8

vendor:igor sysoevmodel:nginxscope:eqversion:1.4.7

Trust: 0.8

vendor:igor sysoevmodel:nginxscope:eqversion:1.5.12

Trust: 0.8

vendor:igor sysoevmodel:nginxscope:ltversion:1.5.x

Trust: 0.8

vendor:nginxmodel:nginxscope:eqversion:1.5.4

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.5

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.3.16

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.4.3

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.5.0

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.4.1

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.4.0

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.3.15

Trust: 0.6

vendor:nginxmodel:nginxscope:eqversion:1.4.2

Trust: 0.6

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

sources: BID: 66537 // JVNDB: JVNDB-2014-001833 // CNNVD: CNNVD-201403-536 // NVD: CVE-2014-0133

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-0133
value: HIGH

Trust: 1.0

NVD: CVE-2014-0133
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201403-536
value: HIGH

Trust: 0.6

VULHUB: VHN-67626
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-0133
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2014-0133
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-67626
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-67626 // JVNDB: JVNDB-2014-001833 // CNNVD: CNNVD-201403-536 // NVD: CVE-2014-0133

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-119

Trust: 0.9

sources: VULHUB: VHN-67626 // JVNDB: JVNDB-2014-001833 // NVD: CVE-2014-0133

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201403-536

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201403-536

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-001833

PATCH
title:openSUSE-SU-2014:0450url:http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.html
Trust: 0.8
title:CVE-2014-0133url:http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html
Trust: 0.8
title:nginx-1.4.7-3.9.1.x86_64url:http://123.124.177.30/web/xxk/bdxqById.tag?id=48927
Trust: 0.6
title:nginx-1.4.7-3.9.1.srcurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=48926
Trust: 0.6
title:nginx-1.5.12url:http://123.124.177.30/web/xxk/bdxqById.tag?id=48924
Trust: 0.6
title:nginx-1.4.7url:http://123.124.177.30/web/xxk/bdxqById.tag?id=48923
Trust: 0.6
title:nginx-1.4.7url:http://123.124.177.30/web/xxk/bdxqById.tag?id=48922
Trust: 0.6
title:nginx-1.5.12url:http://123.124.177.30/web/xxk/bdxqById.tag?id=48925
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2014-001833 // 
            
            
            
            CNNVD: CNNVD-201403-536

EXTERNAL IDS
db:NVDid:CVE-2014-0133
Trust: 3.0
db:BIDid:66537
Trust: 2.0
db:JVNDBid:JVNDB-2014-001833
Trust: 0.8
db:CNNVDid:CNNVD-201403-536
Trust: 0.7
db:PACKETSTORMid:127175
Trust: 0.2
db:PACKETSTORMid:131099
Trust: 0.2
db:VULHUBid:VHN-67626
Trust: 0.1
sources:
            
            
            VULHUB: VHN-67626 // 
            
            
            
            BID: 66537 // 
            
            
            
            JVNDB: JVNDB-2014-001833 // 
            
            
            
            PACKETSTORM: 127175 // 
            
            
            
            PACKETSTORM: 131099 // 
            
            
            
            CNNVD: CNNVD-201403-536 // 
            
            
            
            NVD: CVE-2014-0133

REFERENCES
url:http://www.securityfocus.com/bid/66537
Trust: 1.7
url:http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html
Trust: 1.7
url:http://lists.opensuse.org/opensuse-updates/2014-03/msg00095.html
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0133
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0133
Trust: 0.8
url:http://nginx.org/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-0133
Trust: 0.2
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:http://security.gentoo.org/
Trust: 0.1
url:http://security.gentoo.org/glsa/glsa-201406-20.xml
Trust: 0.1
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-0133
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:http://advisories.mageia.org/mgasa-2014-0136.html
Trust: 0.1
url:http://www.mandriva.com/en/support/security/
Trust: 0.1
url:http://www.mandriva.com/en/support/security/advisories/
Trust: 0.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3616
Trust: 0.1
url:http://advisories.mageia.org/mgasa-2014-0427.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-3616
Trust: 0.1
sources:
            
            
            VULHUB: VHN-67626 // 
            
            
            
            BID: 66537 // 
            
            
            
            JVNDB: JVNDB-2014-001833 // 
            
            
            
            PACKETSTORM: 127175 // 
            
            
            
            PACKETSTORM: 131099 // 
            
            
            
            CNNVD: CNNVD-201403-536 // 
            
            
            
            NVD: CVE-2014-0133

CREDITS
Lucas Molas
Trust: 0.3
sources:
            
            
            BID: 66537

SOURCES
db:VULHUBid:VHN-67626
db:BIDid:66537
db:JVNDBid:JVNDB-2014-001833
db:PACKETSTORMid:127175
db:PACKETSTORMid:131099
db:CNNVDid:CNNVD-201403-536
db:NVDid:CVE-2014-0133

LAST UPDATE DATE
2024-08-14T15:39:55.232000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-67626date:2021-11-10T00:00:00
db:BIDid:66537date:2014-06-23T06:45:00
db:JVNDBid:JVNDB-2014-001833date:2014-04-01T00:00:00
db:CNNVDid:CNNVD-201403-536date:2023-05-15T00:00:00
db:NVDid:CVE-2014-0133date:2021-11-10T15:59:33.583

SOURCES RELEASE DATE
db:VULHUBid:VHN-67626date:2014-03-28T00:00:00
db:BIDid:66537date:2014-03-18T00:00:00
db:JVNDBid:JVNDB-2014-001833date:2014-04-01T00:00:00
db:PACKETSTORMid:127175date:2014-06-24T00:56:14
db:PACKETSTORMid:131099date:2015-03-30T21:26:01
db:CNNVDid:CNNVD-201403-536date:2014-03-31T00:00:00
db:NVDid:CVE-2014-0133date:2014-03-28T15:55:08.607