Stay Secure with the Latest Linux Advisories

security advisorydenial of servicemoderate threat

Arch Linux 201601-31 Moderate: Nginx Denial Of Service Exploit

The package nginx before version 1.8.1-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201601-31 ========================================= Severity: Medium Date : 2016-01-27 CVE-ID : CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 Package : nginx Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package nginx before version 1.8.1-1 is vulnerable to denial of service. Resolution ========= Upgrade to 1.8.1-1 # pacman -Syu "nginx> =1.8.1-1" The problems have been fixed upstream in version 1.8.1. Workaround ========= None. Description ========== - CVE-2016-0742 (denial of service) Invalid pointer dereference might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause segmentation fault in a worker process. - CVE-2016-0746 (denial of service) Use-after-free condition might occur during CNAME response processing if the "resolver" directive was used, allowing an attacker who is able to trigger name resolution to cause segmentation fault in a worker process, or might have potential other impact. - CVE-2016-0747 (denial of service) CNAME resolution was insufficiently limited if the "resolver" directive was used, allowing an attacker who is able to trigger arbitrary name resolution to cause excessive resource consumption in worker processes. Impact ===== A remote attacker is able to cause a segmentation fault and crash the server. References ========= https://mailman.nginx.org/pipermail/nginx-announce/2016/000168.html . Ubuntu security notice points to Apache flaws that could lead to service interruptions. It is advised to update packages to enhance safety.. denial of service, Arch Linux, nginx exploit. . Severity: Medium. LinuxSecurity.com Team

Jan 27, 2016 •Medium ArchLinux