Bug 1077988 (CVE-2014-0133)

Summary: CVE-2014-0133 nginx: heap-based buffer overflow in SPDY implementation
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: affix, athmanem, jeremy, pavel.lisy, peter.borsa, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nginx 1.4.7 nginx 1.5.12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-03-19 09:43:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1077989    

Description Murray McAllister 2014-03-19 03:42:39 UTC 
The following security flaw in nginx was reported [1]:

""
A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.
""

The version of nginx in EPEL 5 and 6 is too old to be affected.

The Fedora builds do use the "--with-debug" option so should not be affected.

Upstream fix: http://nginx.org/download/patch.2014.spdy2.txt

[1] http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html
Comment 2 Huzaifa S. Sidhpurwala 2014-03-19 05:29:54 UTC 
This issue does not affect the version of nginx as shipped with Fedora 19 and Fedora 20.

This issue does not affect the version of nginx as shipped with EPEL 5 and EPEL 6.