Bug 523302

Summary:	Nginx remote buffer underflow attack
Product:	[Fedora] Fedora	Reporter:	sHaggY_caT <inbox>
Component:	nginx	Assignee:	Jeremy Hinegardner <jeremy>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	low
Version:	11	CC:	jeremy
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-09-14 20:39:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description sHaggY_caT 2009-09-14 20:21:46 UTC

Description of problem:

[Nginx - sHaggY_caT] is vulnerable to a buffer underflow when
processing certain HTTP requests.  An attacker can use this to execute
arbitrary code with the rights of the worker process (www-data on Debian)
or possibly perform denial of service attacks by repeatedly crashing
worker processes via a specially crafted URL in an HTTP request. 
(c), Debian security list

Original message(on Russian lang, translate with google traslate, if don't understand this languge) in mail list:

http://www.lexa.ru/nginx-ru/msg27388.html

Version-Release number of selected component (if applicable):

bad virsions: 0.1.0-0.8.14

In fedora 11 Nginx version is 0.7.61

Comment 1 Jeremy Hinegardner 2009-09-14 20:39:42 UTC


*** This bug has been marked as a duplicate of bug 523105 ***