468962 – www-servers/nginx-1.4.0 is vulnerable to a buffer overflow

Bug 468962 - www-servers/nginx-1.4.0 is vulnerable to a buffer overflow

Summary: www-servers/nginx-1.4.0 is vulnerable to a buffer overflow

Status:	RESOLVED DUPLICATE of bug 468870

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo Security

URL:	http://nginx.org/download/patch.2013....
Whiteboard:	Ars Technica reports that this is bei...
Keywords:	PATCH, SECURITY

Depends on:
Blocks:

Reported:	2013-05-07 23:08 UTC by Robin Kauffman
Modified:	2013-05-08 06:27 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robin Kauffman 2013-05-07 23:08:06 UTC

Hi-
    nginx 1.4.0 is currently vulnerable to a bug introduced in 1.3.9 (buffer overflow/stacksmash triggered by a crafted request).
    First heard about it from Ars: http://arstechnica.com/security/2013/05/attack-hitting-apache-sites-goes-mainstream-hacks-nginx-lighttpd-too/
    The nginx dev team makes mention of it here: http://nginx.org/en/CHANGES-1.4.
    The CVE entry (currently empty) for the bug is at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2028
    The patch is at: http://nginx.org/download/patch.2013.chunked.txt
    You can also just bump to 1.4.1, which includes the patch in the source tree.

        -Robin K.

Comment 1 Qing Lei 2013-05-08 06:22:31 UTC

Changes with nginx 1.4.1                                         07 May 2013

    *) Security: a stack-based buffer overflow might occur in a worker
       process while handling a specially crafted request, potentially
       resulting in arbitrary code execution (CVE-2013-2028); the bug had
       appeared in 1.3.9.
       Thanks to Greg MacManus, iSIGHT Partners Labs.

http://nginx.org/en/CHANGES-1.4

Comment 2 Benedikt Böhm (RETIRED) gentoo-dev

2013-05-08 06:27:24 UTC


*** This bug has been marked as a duplicate of bug 468870 ***