nginx: arbitrary code execution
| Package(s): | nginx | CVE #(s): | CVE-2009-2629 | ||||||||||||||||||||||||||||
| Created: | September 14, 2009 | Updated: | December 7, 2009 | ||||||||||||||||||||||||||||
| Description: | From the Debian advisory: Chris Ries discovered that nginx, a high-performance HTTP server, reverse proxy and IMAP/POP3 proxy server, is vulnerable to a buffer underflow when processing certain HTTP requests. An attacker can use this to execute arbitrary code with the rights of the worker process (www-data on Debian) or possibly perform denial of service attacks by repeatedly crashing worker processes via a specially crafted URL in an HTTP request. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||