nginx vulnerable to MITM Attack [CVE-2011-4968]

[Thomas Ward]

I am reporting this bug so there's a bug to track this in within Launchpad. If/when a patch is approved upstream, this bug can be used as a reference point in the changelog when SRU-ing the fix into older releases.

Confirmed as Debian Bug 697940.
Confirmed as CVE-2011-4968.

This has already been added to the Ubuntu Security Team Tracker at http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-4968.html

Information as follows comes from the Debian Bug:
"When nginx is configured as a reverse proxy with an https origin server, it is vulnerable to a MITM attack, because it does not verify the certificate of the origin server.

This is upstream's bug https://trac.nginx.org/nginx/ticket/13, and also CVE-2011-4968.

It appears to have been known for over a year, but the proposed patches to resolve the problem appear to have never made it through the patch review process in upstream."

Sept. 10, 2015: This was 'fixed' upstream in nginx 1.7.0, with a commit landing upstream about 17 months ago. (see the changeset located at https://trac.nginx.org/nginx/changeset/060c2e692b96a150b584b8e30d596be1f2defa9c/nginx )

[Thomas Ward (teward)]

Oneiric has reached EOL (End of Life) and is no longer supported. As a result, this bug (against Oneiric) is being marked "Won't Fix". Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases.

Please feel free to report any other bugs you may find.

[mik (therealmik)]

I think this has been incorrectly classified as 'low'. People requiring secure connectivity to a backend server are currently receiving a silent downgrade in security.

[Thomas Ward (teward)]

An upstream commit has been made addressing this issue.

Refer to http://trac.nginx.org/nginx/changeset/060c2e692b96a150b584b8e30d596be1f2defa9c/nginx for the fix.

I'll check if the other versions of nginx not listed here are affected later, after work.

[Thomas Ward (teward)]

The nginx project tracker for this task was added to track the status in the PPAs. This has landed in the NGINX PPA for Mainline. It has not been backported to Stable at this time. (Was supposedly fixed in 1.7.0 per http://mailman.nginx.org/pipermail/nginx-devel/2015-February/006484.html)

[Thomas Ward (teward)]

Note on the 'severity' per comment #2: The severity set is based on the severity of the CVE, partly per the Security Team's tracker.

As this has been classified as "low" there, the severity here was set to "Low".

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Thomas Ward (teward)]

Ubuntu Utopic has gone End of Life as of today. As such, this bug is being marked Won't Fix against the Utopic package.

Refer to: https://lists.ubuntu.com/archives/ubuntu-announce/2015-July/000198.html

[Thomas Ward (teward)]

Ubuntu Wily has a fix for this included as part of the 1.9.3-1ubuntu1 merge. The fix for this issue was introduced in nginx 1.7.0.

[Thomas Ward (teward)]

Per the notes on the CVE tracker:

 sarnold> Backporting this fix is non-trivial and may break deployed
  applications. Someone who really wanted this could use stunnel as a
  work-around until 16.04 LTS is released.

This applies to Precise, Trusty, and Vivid.