Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
1–10 of 32 posts
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#2I wonder if this discovery is a result of OpenBSD switching its focus from Apache to Nginx ?
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#3Patch is pretty interesting. Why was buffer overflow protection behind a debug flag?
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#4I wonder if this discovery is a result of OpenBSD switching its focus from Apache to Nginx ?
It wasn't.
> Thanks to Lucas Molas, researcher at Programa STIC, Fundación Dr. Manuel Sadosky, Buenos Aires, Argentina.
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#5Patch is pretty interesting. Why was buffer overflow protection behind a debug flag? http://nginx.org/download/patch.2014.spdy2.txt
Usual reason for mistakes like this is: someone was debugging something then (partially) forgot to clean up before committing.
Once that is done it's incredibly easy for these kind of bugs to go un-noticed for a long time.
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#6I assume this only affects configurations with ngx_http_spdy_module enabled. Can anyone confirm whether or not that's the case?
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#7I assume this only affects configurations with ngx_http_spdy_module enabled. Can anyone confirm whether or not that's the case?
Yup, it's in the announcement: http://mailman.nginx.org/pipermail/nginx-announce/2014/00013...
The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#8Patch is pretty interesting. Why was buffer overflow protection behind a debug flag? http://nginx.org/download/patch.2014.spdy2.txt
And why leave in a #if when patching too?
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#9It said it affected 1.3.15 to 1.5.11 but the fix is available in nginx 1.5.12, 1.4.7.
So for those who are using legacy version are they going to rely on distro vendor to push the patch? Just curious, even though I guess the number of users who have activated this experimental SPDY is low and people who actually have it enabled probably know how to fix it themselves.
Re: Nginx SPDY heap buffer overflow (affects 1.3.15 – 1.5.11)
#10Patch is pretty interesting. Why was buffer overflow protection behind a debug flag? http://nginx.org/download/patch.2014.spdy2.txt
Usual reason for mistakes like this is: someone was debugging something then (partially) forgot to clean up before committing. Once that is done it's incredibly easy for these kind of bugs to go un-noticed for a long time.
Assuming you don't have a test for it, sure. And don't fuzz everything on a regular basis.