Executive Summary

Summary
Title nginx vulnerability
Informations
Name USN-3352-1 First vendor Publication 2017-07-13
Vendor Ubuntu Last vendor Modification 2017-07-13
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04 - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS

Summary:

nginx could be made to expose sensitive information over the network.

Software Description: - nginx: small, powerful, scalable web/proxy server

Details:

It was discovered that an integer overflow existed in the range filter feature of nginx. A remote attacker could use this to expose sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.04:
nginx-common 1.10.3-1ubuntu3.1
nginx-core 1.10.3-1ubuntu3.1
nginx-extras 1.10.3-1ubuntu3.1
nginx-full 1.10.3-1ubuntu3.1
nginx-light 1.10.3-1ubuntu3.1

Ubuntu 16.10:
nginx-common 1.10.1-0ubuntu1.3
nginx-core 1.10.1-0ubuntu1.3
nginx-extras 1.10.1-0ubuntu1.3
nginx-full 1.10.1-0ubuntu1.3
nginx-light 1.10.1-0ubuntu1.3

Ubuntu 16.04 LTS:
nginx-common 1.10.3-0ubuntu0.16.04.2
nginx-core 1.10.3-0ubuntu0.16.04.2
nginx-extras 1.10.3-0ubuntu0.16.04.2
nginx-full 1.10.3-0ubuntu0.16.04.2
nginx-light 1.10.3-0ubuntu0.16.04.2

Ubuntu 14.04 LTS:
nginx-common 1.4.6-1ubuntu3.8
nginx-core 1.4.6-1ubuntu3.8
nginx-extras 1.4.6-1ubuntu3.8
nginx-full 1.4.6-1ubuntu3.8
nginx-light 1.4.6-1ubuntu3.8

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3352-1
CVE-2017-7529

Package Information:
https://launchpad.net/ubuntu/+source/nginx/1.10.3-1ubuntu3.1
https://launchpad.net/ubuntu/+source/nginx/1.10.1-0ubuntu1.3
https://launchpad.net/ubuntu/+source/nginx/1.10.3-0ubuntu0.16.04.2
https://launchpad.net/ubuntu/+source/nginx/1.4.6-1ubuntu3.8

Original Source

Url : http://www.ubuntu.com/usn/USN-3352-1

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 31
Application 466
Application 73

Nessus® Vulnerability Scanner

Date Description
2018-10-16 Name : The remote web server is affected by a data disclosure vulnerability.
File : nginx_1_13_3.nasl - Type : ACT_GATHER_INFO
2018-08-17 Name : The remote PhotonOS host is missing multiple security updates.
File : PhotonOS_PHSA-2017-0038.nasl - Type : ACT_GATHER_INFO
2017-12-18 Name : The remote web server is affected by an integer overflow vulnerability.
File : nginx_1_13_2.nasl - Type : ACT_GATHER_INFO
2017-09-15 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2017-894.nasl - Type : ACT_GATHER_INFO
2017-08-24 Name : The remote Fedora host is missing a security update.
File : fedora_2017-aecd25b8a9.nasl - Type : ACT_GATHER_INFO
2017-08-24 Name : The remote Fedora host is missing a security update.
File : fedora_2017-c27a947af1.nasl - Type : ACT_GATHER_INFO
2017-07-31 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-867.nasl - Type : ACT_GATHER_INFO
2017-07-14 Name : The remote Debian host is missing a security update.
File : debian_DLA-1024.nasl - Type : ACT_GATHER_INFO
2017-07-14 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3352-1.nasl - Type : ACT_GATHER_INFO
2017-07-13 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3908.nasl - Type : ACT_GATHER_INFO
2017-07-12 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_b28adc5b669311e7ad43f0def16c5c1b.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2017-07-27 21:24:58
  • Multiple Updates
2017-07-15 13:25:44
  • Multiple Updates
2017-07-13 21:23:08
  • First insertion