NGINX Unit 0.x > 0.3 / 1.x < 1.7.1 Heap Buffer Overflow (CVE-2019-7401)

critical Nessus Plugin ID 124335

Language:

Synopsis

The remote web server is affected by a heap buffer overflow vulnerability.

Description

According to the self-reported version in its response header, the version of NGINX Unit hosted on the remote web server is 0.x later than 0.3 or 1.x prior to 1.7.1. It is, therefore, affected by a heap buffer overflow vulnerability in the router process. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause a denial of service condition or the execution of arbitrary code.

Solution

Upgrade to NGINX Unit version 1.7.1 or later.

Plugin Details

Severity: Critical

ID: 124335

File Name: nginx_unit_1_7_1.nasl

Version: 1.3

Type: remote

Family: Web Servers

Published: 4/26/2019

Updated: 3/5/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-7401

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nginx:unit

Required KB Items: installed_sw/NGINX Unit

Exploit Ease: No known exploits are available

Patch Publication Date: 2/7/2019

Vulnerability Publication Date: 2/7/2019

Reference Information

CVE: CVE-2019-7401

BID: 106956

Detections

Analytics