PT-2014-1689 · Nginx · Nginx

Published 2014-04-29 · Updated 2021-11-10 · CVE-2014-0088

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.5.10

Description The issue is related to the SPDY implementation in the ngx http spdy module module. It allows remote attackers to execute arbitrary code via a crafted request when running on a 32-bit platform.

Recommendations For version 1.5.10, update to version 1.5.11 or later to resolve the issue. As a temporary workaround, consider disabling the ngx http spdy module module until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-00637

CVE-2014-0088

Affected Products

Nginx

References · 10

• https://cve.org/CVERecord?id=CVE-2014-0088 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0088 · Security Note
• http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html · Patch
• https://ubuntu.com/security/CVE-2014-0088 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0088 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0088 · Security Note
• https://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html · Note
• http://securitytracker.com/id/1030150 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0088 · Note