#VU32813 Use-after-free in nginx - CVE-2012-1180
Vulnerability identifier: #VU32813
Vulnerability risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2012-1180
CWE-ID:
CWE-416
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
nginx
Server applications /
Web servers
Vendor: NGINX
Description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted backend response, in conjunction with a client request. A remote HTTP servers can obtain sensitive information from process memory.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Mitigation
The vendor has issued the following versions to address this vulnerability: 1.0.14, 1.1.17.
Vulnerable software versions
nginx: 1.0.0 - 1.0.13, 1.1.0 - 1.1.16
External links
https://lists.fedoraproject.org/pipermail/package-announce/2012-April/077966.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-March/076646.html
https://lists.fedoraproject.org/pipermail/package-announce/2012-March/076671.html
https://nginx.org/download/patch.2012.memory.txt
https://nginx.org/en/security_advisories.html
https://osvdb.org/80124
https://seclists.org/bugtraq/2012/Mar/65
https://secunia.com/advisories/48465
https://secunia.com/advisories/48577
https://security.gentoo.org/glsa/glsa-201203-22.xml
https://trac.nginx.org/nginx/changeset/4530/nginx
https://trac.nginx.org/nginx/changeset/4531/nginx
https://www.debian.org/security/2012/dsa-2434
https://www.mandriva.com/security/advisories?name=MDVSA-2012:043
https://www.openwall.com/lists/oss-security/2012/03/15/5
https://www.openwall.com/lists/oss-security/2012/03/15/9
https://www.securityfocus.com/bid/52578
https://www.securitytracker.com/id?1026827
https://bugzilla.redhat.com/show_bug.cgi?id=803856
https://exchange.xforce.ibmcloud.com/vulnerabilities/74191
https://hermes.opensuse.org/messages/14173096
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
