PT-2009-5026 · Nginx · Nginx

Chris Ries · Publicado 2009-09-15 · Atualizado 2021-11-10 · CVE-2009-2629

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 0.1.0 through 0.5.37 nginx versions 0.6.x before 0.6.39 nginx versions 0.7.x before 0.7.62 nginx versions 0.8.x before 0.8.15

Description A buffer underflow issue in the src/http/ngx http parse.c file allows remote attackers to execute arbitrary code via crafted HTTP requests.

Recommendations For versions 0.1.0 through 0.5.37, update to a version after 0.5.37. For versions 0.6.x before 0.6.39, update to version 0.6.39 or later. For versions 0.7.x before 0.7.62, update to version 0.7.62 or later. For versions 0.8.x before 0.8.15, update to version 0.8.15 or later.

Exploit

Correção

RCE

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2009-2629

DSA-1884-1

Produtos afetados

Nginx

Referências · 17

• 🔥 https://exploit-db.com/exploits/14830 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2629 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2009-2629 · Nota de Segurança
• http://kb.cert.org/vuls/id/180065 · Nota
• https://osv.dev/vulnerability/CVE-2009-2629 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-2629 · Aviso do Fabricante
• http://sysoev.ru/nginx/patch.180065.txt · Nota
• http://nginx.net/CHANGES-0.5 · Aviso do Fabricante
• http://nginx.net/CHANGES-0.6 · Aviso do Fabricante
• http://nginx.net/CHANGES-0.7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2629 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00428.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00442.html · Aviso do Fabricante
• http://debian.org/security/2009/dsa-1884 · Aviso do Fabricante
• http://nginx.net/CHANGES · Aviso do Fabricante