Integer overflow in nginx (Alpine package)

1) Integer overflow

EUVDB-ID: #VU7410

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-7529

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to integer overflow when processing specially crafted requests. A remote attacker can send a malicious request to vulnerable server and gain access to potentially sensitive information.
 
When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

nginx (Alpine package): 0.8.55-r0 - 1.8.1-r1

External links

http://git.alpinelinux.org/aports/commit/?id=e86a2a9f72ca3473b25cd7ae7085d79c368615b0
http://git.alpinelinux.org/aports/commit/?id=6b75c937d616093cfc19f88eb23252e393cc3307
http://git.alpinelinux.org/aports/commit/?id=daf677dacdc4524021cebc6cb437e53330e6ae67
http://git.alpinelinux.org/aports/commit/?id=568c8a2d9824659603b97fe862a329e1022048b4
http://git.alpinelinux.org/aports/commit/?id=e762c3178d2ceda6617f0437591f0e7b8333912a
http://git.alpinelinux.org/aports/commit/?id=a8736b1ef63631b4ba022004d7eb9012dfea6d24

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.