nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

According to the self-reported version in the Server response header, the installed version of nginx is greater than 0.8.41 but prior to 1.4.4 / 1.5.7. It is, therefore, affected by a security bypass vulnerability in 'ngx_http_parse.c' when a file with a space at the end of the URI is requested.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The nginx webserver was fixed to avoid a restriction bypass when a space in not correctly escaped. (CVE-2013-4547)

The nginx webserver was fixed to avoid a restriction bypass when a space in not correctly escaped. (CVE-2013-4547)

On openSUSE 12.2, nginx was updated to version 1.4.4 stable 

  - CVE-2013-4547 a character following an unescaped space     in a request line was handled incorrectly [bnc#851295]

  - bugfix: segmentation fault might occur in the spdy     module

  - bugfix: segmentation fault might occur on start if if     the 'try_files' directive was used with an empty     parameter.

- Update to the latest version

    - Upstream changelog can be found at       http://nginx.org/en/CHANGES-1.4

    - Security fix BZ 1032267

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the self-reported version in the Server response header, the installed version of nginx is greater than 0.8.41 but prior to 1.4.4 / 1.5.7.  It is, therefore, affected by a security bypass vulnerability in 'ngx_http_parse.c' when a file with a space at the end of the URI is requested.

Updated nginx package fixes security vulnerability :

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).

Ivan Fratric of the Google Security Team discovered a bug in nginx, a web server, which might allow an attacker to bypass security restrictions by using a specially crafted request.

The oldstable distribution (squeeze) is not affected by this problem.

The nginx project reports :

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).

ID	Name	Product	Family	Severity
98953	Nginx < 1.4.4 ngx_parse_http Security Bypass	Web App Scanning	Component Vulnerability	critical
98952	Nginx < 1.5.7 ngx_parse_http Security Bypass	Web App Scanning	Component Vulnerability	critical
75218	openSUSE Security Update : nginx-1.0 (openSUSE-SU-2013:1791-1)	Nessus	SuSE Local Security Checks	high
75210	openSUSE Security Update : nginx (openSUSE-SU-2013:1745-1)	Nessus	SuSE Local Security Checks	high
71405	Fedora 20 : nginx-1.4.4-1.fc20 (2013-22026)	Nessus	Fedora Local Security Checks	high
71266	Amazon Linux AMI : nginx (ALAS-2013-249)	Nessus	Amazon Linux Local Security Checks	high
71147	Fedora 19 : nginx-1.4.4-1.fc19 (2013-21826)	Nessus	Fedora Local Security Checks	high
71117	nginx < 1.4.4 / 1.5.7 ngx_parse_http Security Bypass	Nessus	Web Servers	high
71076	Mandriva Linux Security Advisory : nginx (MDVSA-2013:281)	Nessus	Mandriva Local Security Checks	high
71055	Debian DSA-2802-1 : nginx - restriction bypass	Nessus	Debian Local Security Checks	high
70965	FreeBSD : nginx -- Request line parsing vulnerability (94b6264a-5140-11e3-8b22-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-4547

critical

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high