Detections
Analytics

Nginx < 1.7.5 SSL Session Reuse

high Web App Scanning Plugin ID 98959

Language:

Synopsis

Nginx < 1.7.5 SSL Session Reuse

Description

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 0.5.6 or higher, 1.6.x prior to 1.6.2, or 1.7.x prior to 1.7.5. It is, therefore, affected by an SSL session or TLS session ticket key handling error. A flaw exists in the file 'event/ngx_event_openssl.c' that could allow a remote attacker to obtain sensitive information or to take control of a session. This issue only affects servers having multiple 'server{}' configurations sharing the same values for 'ssl_session_cache' or 'ssl_session_ticket_key'.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to nginx 1.7.5 or later.

See Also

http://bh.ht.vc/vhost_confusion.pdf

http://mailman.nginx.org/pipermail/nginx-announce/2014/000145.html

http://mailman.nginx.org/pipermail/nginx-announce/2014/000146.html

http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html

http://nginx.org/en/CHANGES

http://nginx.org/en/CHANGES-1.6

http://nginx.org/en/security_advisories.html

Plugin Details

Severity: High

ID: 98959

Type: remote

Published: 11/5/2018

Updated: 1/3/2024

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2014-3616

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Score Source: CVE-2014-3616

Vulnerability Information

CPE: cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/8/2014

Vulnerability Publication Date: 12/8/2014

Reference Information

CVE: CVE-2014-3616

BID: 70025