Null pointer dereference in ngx_chain_to_iovec() in NGINX Open Source - CVE-2016-4450
Published: June 24, 2016 / Updated: May 31, 2023
Vulnerability details
The vulnerability allows a remote attacker to cause denial of service conditions on the target system.
The vulnerability exists due to an access control error in the ngx_chain_to_iovec() function, when saving the client request body to a temporary file. A remote unauthenticated attacker can cause a null pointer dereference in the ngx_chain_to_iovec() function by sending specially crafted data.
Successful exploitation of this vulnerability may lead to the crash of a worker process.
Affected software
Arch Linux
Debian Linux
Amazon Linux AMI
Fedora
Ubuntu
Junos OS
nginx (Alpine package)
nginx
rh-nginx18-nginx (Red Hat package)
PowerFlex rack
How to mitigate CVE-2016-4450
The vendor has issued a fix (1.10.1, 1.11.1).
Patch for nginx 1.9.13 - 1.11.0 can be found here:
http://nginx.org/download/patch.2016.write.txt
Patch for older nginx versions (1.3.9 - 1.9.12):
nginx (Alpine package) - update to 1.6.2-r2
Junos OS - addressed in versions 21.4R3-S8, 22.2R3-S5, 22.3R3-S3, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1
nginx - addressed in versions 1.6.3-9.el7, 1.8.1-2.fc23, 1.8.1-3.fc23, 1.10.1-1.el5, 1.10.1-1.el6, 1.10.1-1.fc24
rh-nginx18-nginx (Red Hat package) - addressed in versions 1.8.1-1.el6, 1.8.1-1.el7
PowerFlex rack - update to 3.6.6.0
External References
Related Security Bulletins
- Null pointer dereference in Nginx
- Ubuntu update for nginx
- Arch Linux update for nginx-mainline
- Arch Linux update for nginx
- Debian update for nginx
- Amazon Linux AMI update for nginx
- Null pointer dereference in ngx_chain_to_iovec() in nginx (Alpine package)
- Multiple vulnerabilities in Dell PowerFlex Rack
- Multiple vulnerabilities in Dell PowerFlex Appliance
- Junos OS update for nginx
- Fedora 24 update for nginx
- Fedora 23 update for nginx
- Fedora 23 update for nginx
- Fedora EPEL 7 update for nginx
- Fedora EPEL 6 update for nginx
- Fedora EPEL 5 update for nginx
- Red Hat Software Collections update for rh-nginx18-nginx