The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

According to the self-reported version in the server response header, the installed nginx version is 1.5.10. It is, therefore, affected by a memory corruption vulnerability.

A flaw exists with the SPDY module implementation, where worker process memory could be corrupted via a specially crafted request. This could allow a remote attacker to execute arbitrary code.

Note that the scanner has not tested for this issue or otherwise determined if a patch is applied but has instead relied only on the application's self-reported version number.

According to the self-reported version in the server response header, the installed nginx version is 1.5.10. It is, therefore, affected by a memory corruption vulnerability.

A flaw exists with the SPDY module implementation, where worker process memory could be corrupted via a specially crafted request.
This could allow a remote attacker to execute arbitrary code.

Note that Nessus has not tested for this issue or otherwise determined if a patch is applied but has instead relied only on the application's self-reported version number.

The nginx project reports :

A bug in the experimental SPDY implementation in nginx 1.5.10 was found, which might allow an attacker to corrupt worker process memory by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0088).

The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with the ngx_http_spdy_module module (which is not compiled by default), if the 'spdy' option of the 'listen' directive is used in a configuration file.

ID	Name	Product	Family	Severity
98954	Nginx 1.5.10 SPDY Memory Corruption	Web App Scanning	Component Vulnerability	critical
73894	nginx 1.5.10 SPDY Memory Corruption	Nessus	Web Servers	medium
72849	FreeBSD : nginx -- SPDY memory corruption (89db3b31-a4c3-11e3-978f-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2014-0088

critical

Tenable Plugins

critical

medium

high