Buffer overflow in nginx



Published: 2014-04-29 | Updated: 2020-08-10
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2014-0088
CWE-ID CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
nginx
Server applications / Web servers

Vendor NGINX

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU41742

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-0088

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

Mitigation

Install update from vendor's website.

Vulnerable software versions

nginx: 1.5.10

External links

http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html
http://www.securitytracker.com/id/1030150


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###