Multiple vulnerabilities in nginx



| Updated: 2021-09-21
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2016-0742
CVE-2016-0746
CVE-2016-0747
CWE-ID CWE-476
CWE-416
CWE-400
Exploitation vector Network
Public exploit N/A
Vulnerable software
 nginx
Server applications / Web servers

Vendor NGINX

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU56735

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-0742

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within resolver in nginx when processing UDP DNS packets. A remote attacker can send a specially crafted UDP DNS response to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

nginx: 0.6.18 - 1.9.9

CPE2.3 External links

https://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html
https://mailman.nginx.org/pipermail/nginx/2016-January/049700.html
https://www.debian.org/security/2016/dsa-3473
https://www.securitytracker.com/id/1034869
https://www.ubuntu.com/usn/USN-2892-1
https://access.redhat.com/errata/RHSA-2016:1425
https://bto.bluecoat.com/security-advisory/sa115
https://bugzilla.redhat.com/show_bug.cgi?id=1302587
https://security.gentoo.org/glsa/201606-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU56736

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-0746

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted DNS response related to CNAME response processing within the resolver in nginx. A remote attacker can send a specially crafted DNS response to the affected server, trigger a use-after-free error and perform a denial of service attack or execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

nginx: 0.6.18 - 1.9.9

CPE2.3 External links

https://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html
https://mailman.nginx.org/pipermail/nginx/2016-January/049700.html
https://www.debian.org/security/2016/dsa-3473
https://www.securitytracker.com/id/1034869
https://www.ubuntu.com/usn/USN-2892-1
https://access.redhat.com/errata/RHSA-2016:1425
https://bto.bluecoat.com/security-advisory/sa115
https://bugzilla.redhat.com/show_bug.cgi?id=1302588
https://security.gentoo.org/glsa/201606-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU56737

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-0747

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly limit the CNAME resolution within resolver component. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack by send a specially crafted DNS response.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

nginx: 0.6.18 - 1.9.9

CPE2.3 External links

https://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html
https://mailman.nginx.org/pipermail/nginx/2016-January/049700.html
https://www.debian.org/security/2016/dsa-3473
https://www.securitytracker.com/id/1034869
https://www.ubuntu.com/usn/USN-2892-1
https://access.redhat.com/errata/RHSA-2016:1425
https://bto.bluecoat.com/security-advisory/sa115
https://bugzilla.redhat.com/show_bug.cgi?id=1302589
https://security.gentoo.org/glsa/201606-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###