Уязвимость в nginx (Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability
Vulnerability Note VU#180065
http://www.kb.cert.org/vuls/id/180065
Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability
Overview
A vulnerability in the nginx web server may allow remote attackers to execute arbitrary code on an affected system.
I. Description
nginx is an HTTP server and mail proxy server that is available for a number of different platforms. A buffer underflow vulnerability exists in the ngx_http_parse_complex_uri() function when handling specially crafted URIs. Exploitation of this vulnerability would cause the nginx server to write data contained in the URI to heap memory before the allocated buffer.
II. Impact
As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.
Vulnerability Note VU#180065
http://www.kb.cert.org/vuls/id/180065
Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability
Overview
A vulnerability in the nginx web server may allow remote attackers to execute arbitrary code on an affected system.
I. Description
nginx is an HTTP server and mail proxy server that is available for a number of different platforms. A buffer underflow vulnerability exists in the ngx_http_parse_complex_uri() function when handling specially crafted URIs. Exploitation of this vulnerability would cause the nginx server to write data contained in the URI to heap memory before the allocated buffer.
II. Impact
As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.