SB2024101119 - Junos OS update for nginx
Published: October 11, 2024 Updated: May 9, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 secuirty vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2019-20372)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists with certain error_page configurations. A remote attacker can read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
2) Resource exhaustion (CVE-ID: CVE-2023-44487)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".
Note, the vulnerability is being actively exploited in the wild.
3) Out-of-bounds read (CVE-ID: CVE-2022-41742)
The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service attack.
The vulnerability exists due to a boundary condition within the ngx_http_mp4_module module when handling MP4 files. A remote attacker can pass a specially crafted file to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
4) Out-of-bounds read (CVE-ID: CVE-2022-41741)
The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform a denial of service attack.
The vulnerability exists due to a boundary condition within the ngx_http_mp4_module module when handling MP4 files. A remote attacker can pass a specially crafted file to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service attack.
5) Off-by-one (CVE-ID: CVE-2021-23017)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to an off-by-one error within the ngx_resolver_copy() function when processing DNS responses. A remote attacker can trigger an off-by-one error, write a dot character (‘.’, 0x2E) out of bounds in a heap allocated buffer and execute arbitrary code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
The vulnerability can be triggered by a DNS response in reply to a DNS request from nginx when the resolver primitive is configured. A specially crafted packet allows overwriting the least significant byte of next heap chunk metadata with 0x2E.
6) Origin validation error (CVE-ID: CVE-2021-3618)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to a logic error in TLS implementation when handling different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A remote attacker with ability to perform TCP/IP layer MitM attack can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
This attack technique was dubbed ALPACA (application layer protocol content confusion
attack).
7) Buffer over-read (CVE-ID: CVE-2018-16845)
The vulnerability allows a remote attacker to gain access to potentially sensitive information or trigger denial of service conditions.
The vulnerability exists due to a boundary condition when processing headers of MP4 files within the ngx_http_mp4_module module. A remote attacker can create a specially crafted MP4 file, trick the victim into uploading it on the server and trigger application crash or disclosure of the worker's process memory.
Successful exploitation of the vulnerability requires that nginx is compiled with support for ngx_http_mp4_module module (not a default configuration).
8) NULL pointer dereference (CVE-ID: CVE-2016-0742)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within resolver in nginx when processing UDP DNS packets. A remote attacker can send a specially crafted UDP DNS response to the application and perform a denial of service (DoS) attack.
9) Integer overflow (CVE-ID: CVE-2017-20005)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within the ngx_gmtime() function when processing dates within the autoindex module. A remote attacker with the ability to pass a file to the server with a specially crafted timestamp with a year prior to 1970 and after the year 10000, trigger an integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
10) Integer overflow (CVE-ID: CVE-2017-7529)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.The vulnerability exists due to integer overflow when processing specially crafted requests. A remote attacker can send a malicious request to vulnerable server and gain access to potentially sensitive information.
When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information.
11) Null pointer dereference in ngx_chain_to_iovec() (CVE-ID: CVE-2016-4450)
The vulnerability allows a remote attacker to cause denial of service conditions on the target system.
The vulnerability exists due to an access control error in the ngx_chain_to_iovec() function, when saving the client request body to a temporary file. A remote unauthenticated attacker can cause a null pointer dereference in the ngx_chain_to_iovec() function by sending specially crafted data.
Successful exploitation of this vulnerability may lead to the crash of a worker process.
12) Privilege escalation (CVE-ID: CVE-2016-1247)
The vulnerability allows a local user to gain elevated privileges on the target system.The weakness is due to improper handling of log file permissions in the '/var/log/nginx' directory by nginx packages. A locall attacker with 'www-data' user privileges can obtain root privileges on the target system.
Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.
13) Resource exhaustion (CVE-ID: CVE-2016-0747)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly limit the CNAME resolution within resolver component. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack by send a specially crafted DNS response.
14) Use-after-free (CVE-ID: CVE-2016-0746)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted DNS response related to CNAME response processing within the resolver in nginx. A remote attacker can send a specially crafted DNS response to the affected server, trigger a use-after-free error and perform a denial of service attack or execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Remediation
Install update from vendor's website.