[VU:180065] Nginx ngx_http_parse_complex_uri() buffer underflow vulnerability

Overview

A vulnerability in the nginx web server may allow remote attackers to execute arbitrary code on an affected system.

Impact

As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.

Solution

Upgrade or apply a patch Updated versions of the nginx package have been released to address this issue. Users should consult the Systems Affected section of this document for information about specific vendors.

Acknowledgements

Thanks to Chris Ries of the Carnegie Mellon University Information Security Office for reporting this vulnerability.