Cloudanix VulnDB

CVE-2016-0742

High · 7.5

CVSS

7.5

EPSS

82.4%

Published

Feb 15, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A problem in the nginx web server software could let attackers send special network messages that crash the server and interrupt website availability.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Invalid pointer dereference in nginx DNS resolver when processing crafted UDP responses leads to worker process crash.

Why it matters to the business

Potential denial-of-service outages for web services relying on nginx DNS resolution; high exploit probability indicated by EPSS but no known ransomware or KEV usage despite widespread historical exposure.

How an attack unfolds

An attacker sends a specially crafted UDP DNS response to an nginx instance performing DNS resolution, triggering the memory corruption in the resolver code and crashing the worker process.

How to fix it

Upgrade nginx to a build containing commit 0269c7a312bf754dcee68a36d055aea0989046f3 or later releases (1.8.1 or 1.9.10 and above).

How to confirm the fix worked

Verify installed nginx version against fixed commit or release thresholds; monitor worker process stability under DNS load.

Typical attack path

  1. Identify nginx instances performing outbound DNS queries
  2. Craft malicious UDP DNS response packet
  3. Transmit packet to trigger resolver path
  4. Cause invalid pointer dereference and worker crash

How to detect it

Search nginx error logs and system logs for worker process crashes correlated with DNS resolver activity; inspect inbound UDP traffic on DNS ports for anomalies.

What your security team should do

  • Prioritize upgrade of all nginx deployments to the fixed commit or newer releases
  • Review resolver configuration to limit unnecessary DNS lookups
  • Implement network controls to filter unexpected DNS responses

The record

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 nginx 0 1.9.10-1
Debian:12 nginx 0 1.9.10-1
Debian:13 nginx 0 1.9.10-1
Debian:6.0 nginx 0 0.7.67-3+squeeze4+deb6u1
Debian:7 nginx 0 1.2.1-2.2+wheezy4
Debian:8 nginx 0 1.6.2-5+deb8u1
Mageia:5 nginx 0 1.6.2-5.1.mga5
Red Hat:rhel_software_collections:2::el6 rh-nginx18-nginx 0 1:1.8.1-1.el6
Red Hat:rhel_software_collections:2::el6 rh-nginx18-nginx-debuginfo 0 1:1.8.1-1.el6
Red Hat:rhel_software_collections:2::el7 rh-nginx18-nginx 0 1:1.8.1-1.el7
Red Hat:rhel_software_collections:2::el7 rh-nginx18-nginx-debuginfo 0 1:1.8.1-1.el7
SUSE:Lifecycle Management Server 1.3 GeoIP 0 1.4.7-2.10.1
SUSE:Lifecycle Management Server 1.3 nginx-1.0 0 1.0.15-0.29.2
SUSE:Studio Onsite 1.3 GeoIP 0 1.4.7-2.10.1
SUSE:Studio Onsite 1.3 nginx-1.0 0 1.0.15-0.29.2
SUSE:WebYast 1.3 GeoIP 0 1.4.7-2.10.1
SUSE:WebYast 1.3 nginx-1.0 0 1.0.15-0.29.2
Ubuntu:14.04:LTS nginx 0 1.4.6-1ubuntu3.4
Ubuntu:16.04:LTS nginx 0 1.9.10-0ubuntu1
openSUSE:Tumbleweed nginx 0 1.11.4-2.5

Related vulnerabilities