Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.

According to its Sever response header, the installed version of nginx is 1.0.x prior to 1.0.15 or 1.1.x prior to 1.1.19. It is, therefore, affected by the following issue :

  - Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14     and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of     service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. (CVE-2012-2089)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201206-07 (nginx: User-assisted execution of arbitrary code)

    An error in ngx_http_mp4_module.c could cause a buffer overflow.
    NOTE: nginx must have been emerged with USE='nginx_modules_http_mp4' in       order to be affected by this vulnerability.
  Impact :

    A remote attacker could entice a user to place a specially crafted MP4       file on the nginx server, possibly resulting in execution of arbitrary       code with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Update to 1.0.15

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.0.15 and enable _hardened_build

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a nginx HTTP server. 

 Versions earlier than 1.0.15(stable version) or versions earlier than 1.1.19(development version) are vulnerable to a buffer-overflow vulnerability because it fails to perform adequate checks on user-supplied input. An attacker can exploit this issue by using a specially-crafted mp4 file, allowing the attacker to execute arbitrary code in the context of the application. (CVE-2012-2089)

The nginx project reports :

Buffer overflow in the ngx_http_mp4_module

The remote web server is running nginx, a lightweight, high performance web server / reverse proxy and email (IMAP/POP3) proxy. 

According to its Server response header, the installed version of nginx is between 1.0.7 and 1.0.14 or 1.1.3 and 1.1.18 and is, therefore, affected by a buffer overflow vulnerability. 

An error in the module 'ngx_http_mp4_module' can allow a specially crafted mp4 file to cause a buffer overflow and can potentially allow arbitrary code execution. 

Note that successful exploitation requires that the 'mp4' configuration option is enabled and the module 'ngx_http_mp4_module' is enabled. Nessus has not checked for either of these settings.

ID	Name	Product	Family	Severity
198223	nginx 1.1.x < 1.1.19 / 1.0.x < 1.0.15 A Buffer Overflow Vulnerability	Nessus	Web Servers	critical
69681	Amazon Linux AMI : nginx (ALAS-2012-74)	Nessus	Amazon Linux Local Security Checks	medium
59645	GLSA-201206-07 : nginx: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
58934	Fedora 16 : nginx-1.0.15-1.fc16 (2012-6411)	Nessus	Fedora Local Security Checks	medium
58929	Fedora 15 : nginx-1.0.15-1.fc15 (2012-6371)	Nessus	Fedora Local Security Checks	medium
58915	Fedora 17 : nginx-1.0.15-2.fc17 (2012-6238)	Nessus	Fedora Local Security Checks	medium
6458	nginx < 1.0.15 / 1.1.x < 1.1.19 Buffer-Overflow Vulnerability	Nessus Network Monitor	Web Servers	medium
58756	FreeBSD : nginx -- Buffer overflow in the ngx_http_mp4_module (0c14dfa7-879e-11e1-a2a0-00500802d8f7)	Nessus	FreeBSD Local Security Checks	medium
58750	nginx 1.0.7 - 1.0.14 / 1.1.3 - 1.1.18 ngx_http_mp4_module Buffer Overflow	Nessus	Web Servers	medium

Detections

Analytics

CVE-2012-2089

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium