What is wrong
A buffer underflow vulnerability exists in the HTTP request parsing code of nginx. Remote attackers can exploit this flaw using crafted HTTP requests to execute arbitrary code on the target server.
Who is affected
This affects nginx versions 0.1.0 through 0.5.37, 0.6.x prior to 0.6.39, 0.7.x prior to 0.7.62, and 0.8.x prior to 0.8.15.
What to do
Upgrade to fixed nginx versions 0.5.38, 0.6.39, 0.7.62, or 0.8.15 depending on the installed release branch.
Original description
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.
Affected software
- nginx ≥ 0.1.0 < 0.5.38≥ 0.7.0 < 0.7.62≥ 0.6.0 < 0.6.39≥ 0.8.0 < 0.8.15 Fixed in: 0.5.38, 0.7.62, 0.6.39, 0.8.15 exact match
Details
- Published
- 2009-09-16
- Last modified
- 2024-08-07
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- EPSS (30-day exploit probability)
- 75.08% (percentile 100)
References
- cve.org/CVE-2009-2629
- nvd.nist.gov/vuln/detail/CVE-2009-2629
- www.kb.cert.org/vuls/id/180065
- www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html
- nginx.net/CHANGES-0.7
- nginx.net/CHANGES
- sysoev.ru/nginx/patch.180065.txt
- www.debian.org/security/2009/dsa-1884
- www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html
- www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html
- nginx.net/CHANGES-0.5
- nginx.net/CHANGES-0.6
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.