[Bug 1294280] [NEW] [CVE-2014-0133] SPDY Heap Buffer Overflow Vulnerability

[Thomas Ward]

*** This bug is a security vulnerability ***

Public security bug reported:

This is CVE-2014-0133.

This is Debian Bug 742059.

------

This was the nginx announcement of this issue:

Hello!

A bug in the experimental SPDY implementation in nginx was found, which
might allow an attacker to cause a heap memory buffer overflow in a
worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the
ngx_http_spdy_module module (which is not compiled by default) and
without --with-debug configure option, if the "spdy" option of the
"listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

Patch for the problem can be found here:

http://nginx.org/download/patch.2014.spdy2.txt

Thanks to Lucas Molas, researcher at Programa STIC, Fundación Dr. Manuel
Sadosky, Buenos Aires, Argentina.

------

Trusty and Saucy are affected.

** Affects: nginx (Ubuntu)
     Importance: Undecided
         Status: Confirmed

** Affects: nginx (Debian)
     Importance: Unknown
         Status: Unknown

** Bug watch added: Debian Bug tracker #742059
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742059

** Also affects: nginx (Debian) via
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742059
   Importance: Unknown
       Status: Unknown

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-0133

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to nginx in Ubuntu.
https://bugs.launchpad.net/bugs/1294280

Title:
  [CVE-2014-0133] SPDY Heap Buffer Overflow Vulnerability

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1294280/+subscriptions