3 ms·

18 year old critical vulnerability found in Nginx

• ktpsns 5mo ago
  Severe, but you also need to use quite specific configuration to be vulnerable. I can imagine this pattern to be widespread in some classical PHP applications deployed via nginx.
  • jungfty 5mo ago
    [dead]
• ChrisArchitect 5mo ago
  better links: https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability https://depthfirst.com/research/nginx-rift-achieving-nginx-r... (https://news.ycombinator.com/item?id=48126029 https://news.ycombinator.com/item?id=48126029) https://depthfirst.com/nginx-rift https://depthfirst.com/nginx-rift (https://news.ycombinator.com/item?id=48123365 https://news.ycombinator.com/item?id=48123365)
• yottamus 5mo ago
  F5 says: "Additionally, for systems with Address Space Layout Randomization (ASLR ) disabled, code execution is possible." https://my.f5.com/manage/s/article/K000161019 https://my.f5.com/manage/s/article/K000161019 But in the write up it says: "Luckily, NGINX uses a multi process architecture where worker processes fork from a single master process. Because of this design, the memory space is duplicated exactly for every child worker. This means the heap layout remains entirely deterministic across different workers. If our exploit fails and crashes a worker, the master process simply spawns a new one with the exact same memory layout. This allows us to safely try multiple times until we succeed without worrying about the worker crashing and changing the memory layout. Theoretically, we could leverage this design to leak ASLR by progressively overwriting pointers byte by byte." Is this F5 being dishonest?