nginx 漏洞（适用于0.1.0-0.8.14）补丁

文章来源:http://xok.la/

漏洞介绍：
http://www.kb.cert.org/vuls/id/180065

As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.

补丁说明：http://sysoev.ru/nginx/patch.180065.txt

进入Nginx源码包，找到src/http/ngx_http_parse.c 文件，修改：

u -= 4;
             if (u < r->uri.data) {
                         return NGX_HTTP_PARSE_INVALID_REQUEST;
                                                                }
                     while (*(u - 1) != '/') {

为

u -= 5;
        for ( ;; ) {
             if (u < r->uri.data) {
             return NGX_HTTP_PARSE_INVALID_REQUEST;
                                        }
              if (*u == '/') {
                                  u++;
                                  break;
                                }

然后重新编译。

官网补丁说明：

Index: src/http/ngx_http_parse.c
===================================================================
--- src/http/ngx_http_parse.c (revision 2410)
+++ src/http/ngx_http_parse.c (revision 2411)
@@ -1134,11 +1134,15 @@
#endif
                         case '/':
                                 state = sw_slash;
-                                u -= 4;
-                                if (u < r->uri.data) {
-                                        return NGX_HTTP_PARSE_INVALID_REQUEST;
-                                }
-                                while (*(u - 1) != '/') {
+                                u -= 5;
+                                for ( ;; ) {
+                                        if (u < r->uri.data) {
+                                                return NGX_HTTP_PARSE_INVALID_REQUEST;
+                                        }
+                                        if (*u == '/') {
+                                                u++;
+                                                break;
+                                        }
                                         u--;
                                 }
                                 break;

转载于:https://blog.51cto.com/cqfish/202987

nginx 漏洞（适用于0.1.0-0.8.14）补丁相关推荐

PHP 5.5.38 + mysql 5.0.11 + zabbix3.0 + nginx 安装
PHP 5.5.38 + mysql 5.0.11 + zabbix3.0 + nginx 1.首先在安装好环境下安装 zabbix3.0情况下 2. yum install mysql-devel ...
vc++ 6.0 创建程序快捷方式的一个例子源码_漏洞复现:phpcms v9.6.0任意文件上传漏洞(CVE201814399)...
文章说明漏洞复现是为了学习漏洞利用所写,漏洞都是互联网上以流传已久的各种漏洞的利用及原理,用来增强自己见识,培养自己动手能力,有兴趣的朋友可自行搭建环境练习.源码下载连接在文章最后. 漏洞说明 PH ...
Linux配置Nginx与PHP-FPM出现[error] 80143#0: *1 connect() failed (111: Connection refused) while connectin
原因是只启动了nginx 没有启动php-fpm /usr/local/sbin/php-fpm [root@localhost ~]# ps aux | grep 'php-fpm' root 80 ...
解决Mac nginx问题 [emerg] 54933#0: bind() to 0.0.0.0:80 failed (13: Permission denied)
brew services restart nginx Stopping nginx... (might take a while) ==> Successfully stopped nginx ...
构建适用于Oracle 11.2.0.x的Linux单数据库实例的DataGuard
构建适用于Oracle 11.2.0.x的Linux单数据库实例的DataGuard 使用脚本自动化构建Oracle DataGuard 下载脚本 git clone https://github.c ...
thinkphp3.2.3漏洞_Chrome新版本修复CVE202015999 0 day漏洞
10月20日,谷歌发布新版本的Chrome 86.0.4240.111,新版本中共修复了5个安全漏洞,其中一个是0 day 漏洞CVE-2020-15999.Windows.mac和Linux桌面版用 ...
渗透测试实战-OTRS 5.0.x/6.0.x漏洞利用
nmap -T4 -A -sS -sV -vv --script vuln -p- --open -n -Pn 10.11.1.39 -oX 10.11.1.39.xml xsltproc -o 10 ...
nginx启动失败（bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket…permissions)
nginx启动失败,端口被占用 nginx启动失败(bind() to 0.0.0.0:80 failed (10013: An attempt was made to access a socket ...
适用于Apache Hadoop 2.0 M5的Spring
Spring高兴地宣布了Spring for Apache Hadoop 2.0 M5里程碑版本,同时它们也越来越接近候选版本. 在Spring博客中 ,新版本2.0与1.0版本之间有很好的比较. 根 ...

nginx 漏洞（适用于0.1.0-0.8.14）补丁

nginx 漏洞（适用于0.1.0-0.8.14）补丁相关推荐

最新文章

热门文章