Nginx Integer Overflow Vulnerability

The security research team recently discovered a severe nginx vulnerability, which exists in nginx's ngx_http_close_connection function. Attackers can construct r-> count less than 0 or greater than 255 malicious HTTP requests, this vulnerability may remotely execute arbitrary code. According to 360, all nginx versions are affected.

The original article is as follows:

Web: http://safe3.com.cn

I. BACKGROUND
---------------------

Nginx is an HTTP and reverse proxy server, as well as a mail proxy server, written by Igor Sysoev. for a long time, it has been running on your heavily loaded Russian sites including Yandex, Mail. ru, VKontakte, and Rambler. according to Netcraft nginx served or proxied 12.96% busiest sites in logs l 2013. here are some of the success stories: Netflix, WordPress.com, FastMail. FM.

II. DESCRIPTION
---------------------

Qihoo 360 Web Security Research Team discovered a critical vulnerability in nginx.

The vulnerability is caused by a int overflow error within the Nginx
Ngx_http_close_connection function when r-> count is less then 0 or more then 255, which cocould be exploited
By remote attackers to compromise a vulnerable system via malicious http requests.

III. AFFECTED PRODUCTS
---------------------------

Nginx all latest version

IV. Exploits/PoCs
---------------------------------------

In-depth technical analysis of the vulnerability and a fully functional remote code execution exploit are available through the safe3q (at) gmail (dot) com [email concealed]
In src \ http \ ngx_http_request_body.c ngx_http_discard_request_body function, we can make r-> count ++.

V. VUPEN Threat Protection Program
-----------------------------------

VI. SOLUTION
----------------

Validate the r-> count input.

VII. CREDIT
--------------

This vulnerability was discovered by Safe3 of Qihoo 360.

VIII. ABOUT Qihoo 360
---------------------------

Qihoo 360 is the leading provider of defensive and offensive web cloud security of China.

IX. REFERENCES
----------------------

Http://nginx.org/en/source http://packetstormsecurity.com/files/121416/nginx-intoverflow.txt