Stack-based buffer overflow in NGINX Open Source - CVE-2013-2028

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ngx_http_parse_chunked function in http/ngx_http_parse.c when processing a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2013-2028

Links to Public Exploits and PoC-codes

• Exploit #4956 - CVE-2013-2028-Exploit (CVE-2013-2028 python exploit) (December 23, 2020)
• Exploit #4518 - nginxpwn (Exploitation Training -- CVE-2013-2028: Nginx Stack Based Buffer Overflow) (August 21, 2020)
• Exploit #4097 - Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC) (August 11, 2020)
• Exploit #4054 - Nginx 1.3.9 < 1.4.0 - Chuncked Encoding Stack Buffer Overflow (Metasploit) (August 11, 2020)
• Exploit #4046 - Nginx 1.4.0 (x64) (Generic Linux) - Remote Exploit (August 11, 2020)
• Exploit #4053 - Nginx 1.3.9/1.4.0 (x86) - Brute Force Remote Exploit (August 11, 2020)
• Exploit #3943 - Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow (August 11, 2020)

External References

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html
• http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html
• http://nginx.org/download/patch.2013.chunked.txt
• http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html
• http://secunia.com/advisories/55181
• http://security.gentoo.org/glsa/glsa-201310-04.xml
• http://www.osvdb.org/93037
• http://www.securityfocus.com/bid/59699
• http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/
• https://github.com/rapid7/metasploit-framework/pull/1834

Related Security Bulletins

• Stack-based buffer overflow in nginx
• Amazon Linux AMI update for nginx
• Gentoo update for nginx