Luis Merino, Markus Vervier and Eric Sesterhenn discovered an off-by-one in Nginx, a high-performance web and reverse proxy server, which could result in denial of service and potentially the execution of arbitrary code.

According to its Server response header, the installed version of nginx is 0.6.18 prior to 1.20.1. It is, therefore, affected by a remote code execution vulnerability. A security issue in nginx resolver was identified, which might allow an unauthenticated remote attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2290 advisory.

    [1.16.1-2.0.1.1]
    - Remove Red Hat references [Orabug: 29498217]

    [1:1.16.1-2.1]
    - Resolves: #1963174 - CVE-2021-23017 nginx:1.16/nginx: Off-by-one in       ngx_resolver_copy() when labels are followed by a pointer to a root       domain name

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2258 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name     (CVE-2021-23017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1815-1 advisory.

  - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP     packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or     potential other impact. (CVE-2021-23017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A security issue in nginx resolver was identified,     which might allow an attacker who is able to forge UDP     packets from the DNS server to cause 1-byte memory     overwrite, resulting in worker process crash or     potential other impact.(CVE-2021-23017)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2259 advisory.

  - A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP     packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or     potential other impact. (CVE-2021-23017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
150115	Debian DSA-4921-1 : nginx - security update	Nessus	Debian Local Security Checks	2021/6/1	2022/9/21	high
150154	nginx 0.6.x < 1.20.1 1-Byte Memory Overwrite RCE	Nessus	Web Servers	2021/6/3	2022/9/15	high
150496	Oracle Linux 8 : nginx:1.16 (ELSA-2021-2290)	Nessus	Oracle Linux Local Security Checks	2021/6/10	2024/11/1	high
150786	RHEL 7 : rh-nginx118-nginx (RHSA-2021:2258)	Nessus	Red Hat Local Security Checks	2021/6/15	2024/11/7	high
151752	openSUSE 15 Security Update : nginx (openSUSE-SU-2021:1815-1)	Nessus	SuSE Local Security Checks	2021/7/16	2023/3/23	high
152409	EulerOS 2.0 SP8 : nginx (EulerOS-SA-2021-2308)	Nessus	Huawei Local Security Checks	2021/8/10	2023/3/23	high
157769	Rocky Linux 8 : nginx:1.18 (RLSA-2021:2259)	Nessus	Rocky Linux Local Security Checks	2022/2/9	2023/11/6	high

检测

插件搜索

high

high

high

high

high

high

high