Buffer over-read in NGINX Open Source - CVE-2018-16845
Published: November 7, 2018
Vulnerability identifier: #VU15743
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16845
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information or trigger denial of service conditions.
The vulnerability exists due to a boundary condition when processing headers of MP4 files within the ngx_http_mp4_module module. A remote attacker can create a specially crafted MP4 file, trick the victim into uploading it on the server and trigger application crash or disclosure of the worker's process memory.
Successful exploitation of the vulnerability requires that nginx is compiled with support for ngx_http_mp4_module module (not a default configuration).
Affected software
NGINX Open Source
Debian Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Junos OS
Fedora
nginx (Alpine package)
nginx
IBM Cloud Private
PowerFlex rack
Debian Linux
Red Hat Enterprise Linux for x86_64
Opensuse
Junos OS
Fedora
nginx (Alpine package)
nginx
IBM Cloud Private
PowerFlex rack
How to mitigate CVE-2018-16845
Install updates from vendor's website.
NGINX Open Source - addressed in versions 1.14.1, 1.15.6
nginx (Alpine package) - update to 1.12.2-r2
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
Junos OS - addressed in versions 21.4R3-S8, 22.2R3-S5, 22.3R3-S3, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1
nginx - addressed in versions 1.14.1-1.fc27, 1.14.1-1.fc28, 1.14.1-2.fc29
PowerFlex rack - update to 3.6.6.0
nginx (Alpine package) - update to 1.12.2-r2
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
Junos OS - addressed in versions 21.4R3-S8, 22.2R3-S5, 22.3R3-S3, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1
nginx - addressed in versions 1.14.1-1.fc27, 1.14.1-1.fc28, 1.14.1-2.fc29
PowerFlex rack - update to 3.6.6.0
External References
Related Security Bulletins
- Multiple vulnerabilities in nginx
- Debian update for nginx
- Red Hat update for nginx
- Red Hat update for nginx
- OpenSUSE Linux update for nginx
- OpenSUSE Linux update for nginx
- Buffer over-read in nginx (Alpine package)
- IBM Cloud Private update for nginx
- Multiple vulnerabilities in Dell PowerFlex Rack
- Multiple vulnerabilities in Dell PowerFlex Appliance
- Junos OS update for nginx
- Fedora 29 update for nginx
- Fedora 28 update for nginx
- Fedora 27 update for nginx