Buffer overflow in NGINX Open Source - CVE-2012-2089
Published: April 18, 2012 / Updated: July 28, 2020
Vulnerability identifier: #VU32819
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2089
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.
Affected software
NGINX Open Source
Amazon Linux AMI
Gentoo Linux
Fedora
nginx (Alpine package)
nginx
Amazon Linux AMI
Gentoo Linux
Fedora
nginx (Alpine package)
nginx
How to mitigate CVE-2012-2089
Install update from vendor's website.
NGINX Open Source - update to 1.0.15
nginx (Alpine package) - update to 1.0.15-r0
nginx - update to 1.0.15-1.el6
nginx (Alpine package) - update to 1.0.15-r0
nginx - update to 1.0.15-1.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079388.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079467.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079474.html
- http://nginx.org/en/security_advisories.html
- http://www.openwall.com/lists/oss-security/2012/04/12/9
- http://www.securityfocus.com/bid/52999
- http://www.securitytracker.com/id?1026924
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74831