BugTraq
Nginx ngx_http_close_connection function integer overflow Apr 25 2013 06:52AM
safe3q gmail com (1 replies)
Re: Nginx ngx_http_close_connection function integer overflow Apr 25 2013 05:51PM
Maxim Konovalov (maxim konovalov gmail com) (1 replies)
Hello,

On Thu, 25 Apr 2013, 06:52-0000, safe3q (at) gmail (dot) com [email concealed] wrote:
[...]
> II. DESCRIPTION
> ---------------------
>
> Qihoo 360 Web Security Research Team discovered a critical vulnerability in nginx.
>
> The vulnerability is caused by a int overflow error within the Nginx
> ngx_http_close_connection function when r->count is less then 0 or
> more then 255, which could be exploited by remote attackers to
> compromise a vulnerable system via malicious http requests.
>
> III. AFFECTED PRODUCTS
> ---------------------------
>
> Nginx all latest version
>
> IV. Exploits/PoCs
> ---------------------------------------
>
> In-depth technical analysis of the vulnerability and a fully
> functional remote code execution exploit are available through the
> safe3q (at) gmail (dot) com [email concealed] In src\http\ngx_http_request_body.c
> ngx_http_discard_request_body function,we can make r->count++.
>
We've done an initial investigation and don't see any problems with
the code you mention. Could you please provide more details to
security-alert (at) nginx (dot) org [email concealed] or to the list?

Thanks in advance,

Maxim Konovalov

--
Maxim Konovalov

[ reply ]
Re: Nginx ngx_http_close_connection function integer overflow Apr 29 2013 03:08PM
Maxim Konovalov (maxim konovalov gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus