Amazon Linux AMI update for nginx

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU32617

Risk: Medium

CVSSv3.1: 6.6 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2013-4547

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

Mitigation

Update the affected packages:

i686:
    nginx-debuginfo-1.4.3-1.14.amzn1.i686
    nginx-1.4.3-1.14.amzn1.i686

src:
    nginx-1.4.3-1.14.amzn1.src

x86_64:
    nginx-1.4.3-1.14.amzn1.x86_64
    nginx-debuginfo-1.4.3-1.14.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2013-249.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.