PT-2014-1689 · Nginx · Nginx

Publicado 2014-04-29 · Atualizado 2021-11-10 · CVE-2014-0088

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.5.10

Description The issue is related to the SPDY implementation in the ngx http spdy module module. It allows remote attackers to execute arbitrary code via a crafted request when running on a 32-bit platform.

Recommendations For version 1.5.10, update to version 1.5.11 or later to resolve the issue. As a temporary workaround, consider disabling the ngx http spdy module module until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-00637

CVE-2014-0088

Produtos afetados

Nginx

Referências · 10

• https://cve.org/CVERecord?id=CVE-2014-0088 · Nota de Segurança
• https://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0088 · Nota de Segurança
• http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html · Correção
• https://ubuntu.com/security/CVE-2014-0088 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0088 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-00637 · Nota de Segurança
• http://securitytracker.com/id/1030150 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0088 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0088 · Nota