PT-2009-5026 · Nginx · Nginx

Chris Ries · Published 2009-09-15 · Updated 2021-11-10 · CVE-2009-2629

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 0.1.0 through 0.5.37 nginx versions 0.6.x before 0.6.39 nginx versions 0.7.x before 0.7.62 nginx versions 0.8.x before 0.8.15

Description A buffer underflow issue in the src/http/ngx http parse.c file allows remote attackers to execute arbitrary code via crafted HTTP requests.

Recommendations For versions 0.1.0 through 0.5.37, update to a version after 0.5.37. For versions 0.6.x before 0.6.39, update to version 0.6.39 or later. For versions 0.7.x before 0.7.62, update to version 0.7.62 or later. For versions 0.8.x before 0.8.15, update to version 0.8.15 or later.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2009-2629

DSA-1884-1

Affected Products

Nginx

References · 17

• 🔥 https://exploit-db.com/exploits/14830 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2629 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-2629 · Security Note
• https://osv.dev/vulnerability/CVE-2009-2629 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2629 · Vendor Advisory
• http://nginx.net/CHANGES-0.5 · Vendor Advisory
• http://nginx.net/CHANGES-0.6 · Vendor Advisory
• http://nginx.net/CHANGES-0.7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2629 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00428.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00442.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1884 · Vendor Advisory
• http://nginx.net/CHANGES · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00449.html · Vendor Advisory
• http://kb.cert.org/vuls/id/180065 · Note