Detections
Analytics
Amazon Linux AMI : nginx (ALAS-2016-655)
high Nessus Plugin ID 89120
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742)A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746)
It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747)
Solution
Run 'yum update nginx' to update your system.See Also
Plugin Details
Severity: High
ID: 89120
File Name: ala_ALAS-2016-655.nasl
Version: 2.4
Type: local
Agent: unix
Published: 3/4/2016
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:nginx, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:nginx-debuginfo
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 2/19/2016
Reference Information
CVE: CVE-2016-0742, CVE-2016-0746, CVE-2016-0747
ALAS: 2016-655