NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7014-3 advisory.

    USN-7014-1 fixed a vulnerability in nginx. This update provides the corresponding update for Ubuntu 14.04     LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7014-2 advisory.

    USN-7014-1 fixed a vulnerability in nginx. This update provides the corresponding updates for Ubuntu 16.04     LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202409-32 (nginx: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7014-1 advisory.

    It was discovered that the nginx ngx_http_mp4 module incorrectly handled certain malformed mp4 files. In     environments where the mp4 directive is in use, a remote attacker could possibly use this issue to cause     nginx to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-7347 advisory.

  - NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an     attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4     file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is     used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the     processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which     have reached End of Technical Support (EoTS) are not evaluated. (CVE-2024-7347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is prior to 1.22.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2024-007 advisory.

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an     attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4     file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is     used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the     processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which     have reached End of Technical Support (EoTS) are not evaluated. (CVE-2024-7347)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-707 advisory.

    NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an     attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4     file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is     used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the     processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which     have reached End of Technical Support (EoTS) are not evaluated. (CVE-2024-7347)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is 1.5.13 to 1.26.2 or 1.27.0. It is, therefore, affected by a security issue was identified in the ngx_http_mp4_module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file (CVE-2024-7347).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-6ba57fd2a3 advisory.

    Security: processing of a specially crafted mp4 file by the            ngx_http_mp4_module might cause a worker process crash            (CVE-2024-7347).
           Thanks to Nils Bars.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-8ba5080dfa advisory.

    Security: processing of a specially crafted mp4 file by the            ngx_http_mp4_module might cause a worker process crash            (CVE-2024-7347).
           Thanks to Nils Bars.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the addc71b8-6024-11ef-86a1-8c164567ca3c advisory.

    The nginx development team reports:
    This update fixes the buffer overread vulnerability in the             ngx_http_mp4_module.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nginx package has been released.

ID	Name	Product	Family	Severity
208960	Ubuntu 14.04 LTS : nginx vulnerability (USN-7014-3)	Nessus	Ubuntu Local Security Checks	medium
208280	Ubuntu 16.04 LTS / 18.04 LTS : nginx vulnerability (USN-7014-2)	Nessus	Ubuntu Local Security Checks	medium
207892	GLSA-202409-32 : nginx: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
207283	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : nginx vulnerability (USN-7014-1)	Nessus	Ubuntu Local Security Checks	medium
207021	CBL Mariner 2.0 Security Update: nginx (CVE-2024-7347)	Nessus	MarinerOS Local Security Checks	medium
206814	Amazon Linux 2 : nginx (ALASNGINX1-2024-007)	Nessus	Amazon Linux Local Security Checks	medium
206808	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2024-707)	Nessus	Amazon Linux Local Security Checks	medium
114422	Nginx 1.5.13 < 1.26.2 Buffer Over-read	Web App Scanning	Component Vulnerability	medium
114421	Nginx 1.27.0 Buffer Over-read	Web App Scanning	Component Vulnerability	medium
206203	Fedora 40 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2024-6ba57fd2a3)	Nessus	Fedora Local Security Checks	medium
206198	Fedora 39 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2024-8ba5080dfa)	Nessus	Fedora Local Security Checks	medium
206115	FreeBSD : nginx -- Vulnerability in the ngx_http_mp4_module (addc71b8-6024-11ef-86a1-8c164567ca3c)	Nessus	FreeBSD Local Security Checks	medium
206093	Photon OS 5.0: Nginx PHSA-2024-5.0-0350	Nessus	PhotonOS Local Security Checks	medium
206089	Photon OS 4.0: Nginx PHSA-2024-4.0-0670	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2024-7347

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium