ANTICHAT — форум по информационной безопасности, OSINT и технологиям

.Light. said:
↑
nginx SPDY heap buffer overflow
Vulnerability description
A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.
This vulnerability affects
Web Server
.
Discovered by: Scripting (Version_Check.script).
Attack details
Current version is : nginx/1.4.6


Retest alert(s)


Mark this alert as a false positive
The impact of this vulnerability
An attacker can cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution
How to fix this vulnerability
Upgrade nginx to the latest version of apply the patch provided by the vendor.
Classification
CWE
CWE-122
CVE
CVE-2014-0133
CVSS
Base Score:
5.1
-
AV:N/AC:H/Au:N/C/I/A/EOC/RL:OF
Access Vector:
Network
Access Complexity:
High
Authentication:
None
Confidentiality Impact:
Partial
Integrity Impact:
Partial
Availability Impact:
Partial
Exploitability:
Proof of concept code
Remediation Level:
Official fix