ArchLinux: 202106-48: nginx-mainline: arbitrary code execution | Li...

Advisories

Arch Linux Security Advisory ASA-202106-48
==========================================

Severity: Medium
Date    : 2021-06-22
CVE-ID  : CVE-2021-23017
Package : nginx-mainline
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1987

Summary
=======

The package nginx-mainline before version 1.21.0-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.21.0-1.

# pacman -Syu "nginx-mainline>=1.21.0-1"

The problem has been fixed upstream in version 1.21.0.

Workaround
==========

The issue can be mitigated by removing the "resolver" directive from
the configuration file.

Description
===========

A security issue in nginx resolver was identified, which might allow an
attacker to cause 1-byte memory overwrite by using a specially crafted
DNS response, resulting in worker process crash or, potentially, in
arbitrary code execution.

The issue only affects nginx if the "resolver" directive is used in the
configuration file. Further, the attack is only possible if an attacker
is able to forge UDP packets from the DNS server.

Impact
======

A remote attacker could crash the nginx server, or potentially execute
arbitrary code, using a crafted DNS server response.

References
==========

https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html
https://nginx.org/download/patch.2021.resolver.txt
https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c5cf
https://security.archlinux.org/CVE-2021-23017

ArchLinux: 202106-48: nginx-mainline: arbitrary code execution

June 24, 2021
The package nginx-mainline before version 1.21.0-1 is vulnerable to arbitrary code execution

Summary

A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution.
The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server.

Resolution

Upgrade to 1.21.0-1.
# pacman -Syu "nginx-mainline>=1.21.0-1"
The problem has been fixed upstream in version 1.21.0.

References

https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html https://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c5cf https://security.archlinux.org/CVE-2021-23017

Severity
CVE-ID : CVE-2021-23017
Package : nginx-mainline
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1987

Impact

A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response.

Workaround

The issue can be mitigated by removing the "resolver" directive fromthe configuration file.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.