The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-005 advisory.

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-22 (NGINX: Privilege escalation)

    It was discovered that Gentoo&rsquo;s default NGINX installation applied       similar problematic permissions on &ldquo;/var/log/nginx&rdquo; as Debian       (DSA-3701) and is therefore vulnerable to the same attack described in       CVE-2016-1247.
  Impact :

    A local attacker, who either is already NGINX&rsquo;s system user or belongs       to NGINX&rsquo;s group, could potentially escalate privileges.
  Workaround :

    Ensure that no untrusted user can create files in directories which are       used by NGINX (or an NGINX vhost) to store log files.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3114-1 advisory.

    Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote     attacker could possibly use this issue to obtain root privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made accessible to local users, and local users may be able to read the log files themselves local until the next logrotate invocation.

ID	Name	Product	Family	Severity
182010	Amazon Linux 2 : nginx (ALASNGINX1-2023-005)	Nessus	Amazon Linux Local Security Checks	high
96416	GLSA-201701-22 : NGINX: Privilege escalation	Nessus	Gentoo Local Security Checks	high
94289	Ubuntu 14.04 LTS / 16.04 LTS : nginx vulnerability (USN-3114-1)	Nessus	Ubuntu Local Security Checks	high
94260	Debian DSA-3701-1 : nginx - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-1247

high

Tenable Plugins

high

high

high

high