[ASA-202106-48] nginx-mainline: arbitrary code execution

[Jonas Witschel]

Arch Linux Security Advisory ASA-202106-48
==========================================

Severity: Medium
Date    : 2021-06-22
CVE-ID  : CVE-2021-23017
Package : nginx-mainline
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1987

Summary
=======

The package nginx-mainline before version 1.21.0-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.21.0-1.

# pacman -Syu "nginx-mainline>=1.21.0-1"

The problem has been fixed upstream in version 1.21.0.

Workaround
==========

The issue can be mitigated by removing the "resolver" directive from
the configuration file.

Description
===========

A security issue in nginx resolver was identified, which might allow an
attacker to cause 1-byte memory overwrite by using a specially crafted
DNS response, resulting in worker process crash or, potentially, in
arbitrary code execution.

The issue only affects nginx if the "resolver" directive is used in the
configuration file. Further, the attack is only possible if an attacker
is able to forge UDP packets from the DNS server.

Impact
======

A remote attacker could crash the nginx server, or potentially execute
arbitrary code, using a crafted DNS server response.

References
==========

https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html
http://nginx.org/download/patch.2021.resolver.txt
https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c5cf
https://security.archlinux.org/CVE-2021-23017
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210624/d11f37dd/attachment.sig>