What is wrong
An invalid pointer dereference vulnerability exists in the nginx resolver. A remote attacker can exploit this by sending a crafted UDP DNS response to crash worker processes, resulting in a denial of service.
Who is affected
This issue affects nginx versions 0.6.18 prior to 1.8.1, as well as 1.9.x versions from 1.9.0 prior to 1.9.10.
What to do
Upgrade nginx to version 1.8.1, 1.9.10, or later.
Original description
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
Affected software
- nginx ≥ 0.6.18 < 1.8.1≥ 1.9.0 < 1.9.10 Fixed in: 1.8.1, 1.9.10 exact match
Details
- Published
- 2016-02-16
- Last modified
- 2024-08-06
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS (30-day exploit probability)
- 82.38% (percentile 100)
References
- cve.org/CVE-2016-0742
- nvd.nist.gov/vuln/detail/CVE-2016-0742
- lists.opensuse.org/opensuse-updates/2016-02/msg00042.html
- bto.bluecoat.com/security-advisory/sa115
- security.gentoo.org/glsa/201606-06
- www.securitytracker.com/id/1034869
- mailman.nginx.org/pipermail/nginx/2016-January/049700.html
- access.redhat.com/errata/RHSA-2016:1425
- www.debian.org/security/2016/dsa-3473
- bugzilla.redhat.com/show_bug.cgi?id=1302587
- www.ubuntu.com/usn/USN-2892-1
- support.apple.com/kb/HT212818
- seclists.org/fulldisclosure/2021/Sep/36
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.