07 May 2013, 16:26

NGINX patches major security flaw

The NGINX developers have released an updated stable version 1.4.1 and development version 1.5.0 to fix a major security flaw in the popular open source web server application. A stack-based buffer overflow is reported to occur in worker processes when handling specially crafted requests – the overflow could be exploited in such a way that it could lead to arbitrary code execution.

The flaw, now given an identity as CVE-2013-2028, appeared in NGINX 1.3.9, a development branch of the server released in November 2012, and appears to have persisted through development to still be present in April's release of the new stable version. A patch is also available for the flaw, which was found by Greg MacManus of iSIGHT Partners Labs.

The updated versions are available to download from the NGINX site. Given that 1.4.0 has only been available for a few weeks, many sites will likely be running the unaffected older stable branch of NGINX – 1.2 – originally published in April 2012, for which the most recent bug-fix release is version 1.2.8, published at the start of April. This is, however, now deemed a legacy version of NGINX.

(djwm)

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-1858438