PT-2012-3799 · Nginx · Nginx

Matthew Daley · Published 2012-04-17 · Updated 2024-06-15 · CVE-2012-2089

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.0.7 through 1.0.14 nginx versions 1.1.3 through 1.1.18

Description A buffer overflow in the ngx http mp4 module module, when the mp4 directive is used, allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted MP4 file. The issue is related to the ngx http mp4 module.c file.

Recommendations For versions 1.0.7 through 1.0.14, update to a version outside of this range to resolve the issue. For versions 1.1.3 through 1.1.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the mp4 directive until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2012-2089

OPENSUSE-SU-2024:10044-1

Affected Products

Nginx

References · 27

• https://cve.org/CVERecord?id=CVE-2012-2089 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079474.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2089 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079388.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2089 · Security Note
• http://openwall.com/lists/oss-security/2012/04/12/9 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079467.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2089 · Vendor Advisory
• http://nginx.org/en/security_advisories.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2014-3556 · Note
• https://suse.com/security/cve/CVE-2012-2089 · Note
• https://suse.com/security/cve/CVE-2013-2070 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 · Note