#VU25 Null pointer dereference in ngx_chain_to_iovec() in nginx - CVE-2016-4450 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU25

#VU25 Null pointer dereference in ngx_chain_to_iovec() in nginx - CVE-2016-4450

Published: June 24, 2016 / Updated: May 31, 2023


Vulnerability identifier: #VU25
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-4450
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
nginx
Software vendor:
F5 Networks

Description

The vulnerability allows a remote attacker to cause denial of service conditions on the target system.

The vulnerability exists due to an access control error in the ngx_chain_to_iovec() function, when saving the client request body to a temporary file. A remote unauthenticated attacker can cause a null pointer dereference in the ngx_chain_to_iovec() function by sending specially crafted data.

Successful exploitation of this vulnerability may lead to the crash of a worker process.


Remediation

The vendor has issued a fix (1.10.1, 1.11.1).

Patch for nginx 1.9.13 - 1.11.0 can be found here:

http://nginx.org/download/patch.2016.write.txt

Patch for older nginx versions (1.3.9 - 1.9.12):

http://nginx.org/download/patch.2016.write2.txt


External links