Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

According to the self-reported version in its response header, the version of nginx hosted on the remote web server is less than 1.8.1 or 1.9.x prior to 1.9.10. It is, therefore, affected by multiple vulnerabilities as noted in the vendor advisory.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the self-reported version in its response header, the version of nginx hosted on the remote web server is less than 1.8.1 or 1.9.x prior to 1.9.10. It is, therefore, affected by multiple vulnerabilities as noted in the vendor advisory.

The remote host is affected by the vulnerability described in GLSA-201606-06 (nginx: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in nginx. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a crafted packet.
  Workaround :

    There is no known workaround at this time.

It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)

A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746)

It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747)

Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the 'resolver' directive is used in a configuration file.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2892-1 advisory.

    It was discovered that nginx incorrectly handled certain DNS server responses when the resolver is     enabled. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of     service. (CVE-2016-0742)

    It was discovered that nginx incorrectly handled CNAME response processing when the resolver is enabled. A     remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-0746)

    It was discovered that nginx incorrectly handled CNAME resolution when the resolver is enabled. A remote     attacker could possibly use this issue to cause nginx to consume resources, resulting in a denial of     service. (CVE-2016-0747)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to nginx 1.8.1 fixes the following issues :

  - CVE-2016-0742: Invalid pointer dereference during DNS     server response processing (boo#963781)

  - CVE-2016-0746: Use-after-free condition during CNAME     response processing (boo#963778)

  - CVE-2016-0747: Resource exhaustion through unlimited     CNAME resolution (boo#963775)

Maxim Dounin reports :

Several problems in nginx resolver were identified, which might allow an attacker to cause worker process crash, or might have potential other impact if the 'resolver' directive is used in a configuration file.

ID	Name	Product	Family	Severity
98963	Nginx < 1.8.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98962	Nginx < 1.9.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
107265	nginx < 1.8.1 / 1.9.x < 1.9.10 Multiple Vulnerabilities	Nessus	Web Servers	high
103587	GLSA-201606-06 : nginx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
89120	Amazon Linux AMI : nginx (ALAS-2016-655)	Nessus	Amazon Linux Local Security Checks	high
88702	Debian DSA-3473-1 : nginx - security update	Nessus	Debian Local Security Checks	high
88678	Ubuntu 14.04 LTS : nginx vulnerabilities (USN-2892-1)	Nessus	Ubuntu Local Security Checks	critical
88614	openSUSE Security Update : nginx (openSUSE-2016-161)	Nessus	SuSE Local Security Checks	high
88503	FreeBSD : nginx -- multiple vulnerabilities (c1c18ee1-c711-11e5-96d6-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-0746

critical

Tenable Plugins

critical

critical

high

high

high

high

critical

high

high