Security Issues Impacting NGINX: 1.8.x, 1.9.x

[Thomas Ward]

This is listed as a Public Security bug as the CVEs and fixes have been announced by NGINX Upstream officially.

There are 3 CVEs impacting all versions of NGINX in Ubuntu. The following is taken from the upstream security announcement on the nginx-announce mailing list (http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html):

- Invalid pointer dereference might occur during DNS server response
 processing, allowing an attacker who is able to forge UDP
 packets from the DNS server to cause worker process crash
 (CVE-2016-0742).

- Use-after-free condition might occur during CNAME response
 processing. This problem allows an attacker who is able to trigger
 name resolution to cause worker process crash, or might
 have potential other impact (CVE-2016-0746).

- CNAME resolution was insufficiently limited, allowing an attacker who
 is able to trigger arbitrary name resolution to cause excessive resource
 consumption in worker processes (CVE-2016-0747).

The problems affect nginx 0.6.18 - 1.9.9 if the "resolver" directive
is used in a configuration file.

The problems are fixed in nginx 1.9.10, 1.8.1.

------

As stated prior, all versions of Ubuntu have an affected version of nginx. There are many commits done by upstream to fix these issues. There are at least 17 of which will need to be examined; as I examine the commits in the upstream commit logs, I will provide links to each commit here.

Xenial will very quickly get a fix, after I push an upload containing nginx 1.9.10 to the repositories.

Wily, having nginx 1.9.3, may be more receptive to patching without any type of changing of the patch to match code changes. This remains to be determined however.

Older versions of Ubuntu, Vivid and earlier, are likely less receptive to the patches, and may need re-engineered to apply to those code bases, given the age of those versions of nginx.

------

This is tracked in Debian as Debian Bug 812806:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812806

[Thomas Ward (teward)]

All versions of nginx in Ubuntu are affected.

------

This went out over the nginx-announce list:

Hello!

Several problems in nginx resolver were identified, which might
allow an attacker to cause worker process crash, or might have
potential other impact:

- Invalid pointer dereference might occur during DNS server response
 processing, allowing an attacker who is able to forge UDP
 packets from the DNS server to cause worker process crash
 (CVE-2016-0742).

- Use-after-free condition might occur during CNAME response
 processing. This problem allows an attacker who is able to trigger
 name resolution to cause worker process crash, or might
 have potential other impact (CVE-2016-0746).

- CNAME resolution was insufficiently limited, allowing an attacker who
 is able to trigger arbitrary name resolution to cause excessive resource
 consumption in worker processes (CVE-2016-0747).

The problems affect nginx 0.6.18 - 1.9.9 if the "resolver" directive
is used in a configuration file.

The problems are fixed in nginx 1.9.10, 1.8.1.

--
Maxim Dounin
http://nginx.org/

[Thomas Ward (teward)]

Debian actually was faster, and uploaded 1.9.10 today. As soon as that is available, I will merge it into Xenial.

[Thomas Ward (teward)]

Importance reset to Medium per Ubuntu Security Team stating the CVEs would be Medium level. (Bug importance set to match)

[Thomas Ward (teward)]

An upload of NGINX 1.9.10 has been done for Xenial, and is now building; marking Fix Committed for Xenial.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nginx - 1.9.10-0ubuntu1

---------------
nginx (1.9.10-0ubuntu1) xenial; urgency=medium

  * New upstream release.
  * debian/patches/ubuntu-branding.patch: Refreshed Ubuntu Branding patch
  * Security content of this upload addresses the following vulnerabilities
    and CVE-numbered Security issues: (LP: #1538165)
    - Invalid pointer dereference might occur during DNS server response
      processing, allowing an attacker who is able to forge UDP
      packets from the DNS server to cause worker process crash
      (CVE-2016-0742).
    - Use-after-free condition might occur during CNAME response
      processing. This problem allows an attacker who is able to trigger
      name resolution to cause worker process crash, or might
      have potential other impact (CVE-2016-0746).
    - CNAME resolution was insufficiently limited, allowing an attacker who
      is able to trigger arbitrary name resolution to cause excessive resource
      consumption in worker processes (CVE-2016-0747).

 -- Thomas Ward <email address hidden> Tue, 26 Jan 2016 14:53:01 -0500

[Thomas Ward (teward)]

The following are upstream changeset links, in order of application:

1.9.x:
http://hg.nginx.org/nginx/rev/81d44cd4044e
http://hg.nginx.org/nginx/rev/7316c57e4fe7
http://hg.nginx.org/nginx/rev/978e79b95c9f
http://hg.nginx.org/nginx/rev/a5767988c022
http://hg.nginx.org/nginx/rev/497d0cff8ace
http://hg.nginx.org/nginx/rev/ff9b32c0e141

1.8.x:
http://hg.nginx.org/nginx/rev/c36482d0a79f
http://hg.nginx.org/nginx/rev/f63dd04c1580
http://hg.nginx.org/nginx/rev/838946300825
http://hg.nginx.org/nginx/rev/5557bf31e25d
http://hg.nginx.org/nginx/rev/dac6eda40475
http://hg.nginx.org/nginx/rev/93d70d87914c

[Thomas Ward (teward)]

As Vivid reaches End of Life tomorrow, and that provides insufficient time for a fix to be produced for that version of the package, we are marking this as "Won't Fix" on Vivid.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nginx - 1.9.3-1ubuntu1.1

---------------
nginx (1.9.3-1ubuntu1.1) wily-security; urgency=medium

  * SECURITY UPDATE: multiple resolver security issues (LP: #1538165)
    - debian/patches/CVE-2016-074x-1.patch: fix possible segmentation fault
      on DNS format error.
    - debian/patches/CVE-2016-074x-2.patch: fix crashes in timeout handler.
    - debian/patches/CVE-2016-074x-3.patch: fixed CNAME processing for
      several requests.
    - debian/patches/CVE-2016-074x-4.patch: change the
      ngx_resolver_create_*_query() arguments.
    - debian/patches/CVE-2016-074x-5.patch: fix use-after-free memory
      accesses with CNAME.
    - debian/patches/CVE-2016-074x-6.patch: limited CNAME recursion.
    - CVE-2016-0742
    - CVE-2016-0743
    - CVE-2016-0744

 -- Marc Deslauriers <email address hidden> Wed, 03 Feb 2016 08:38:22 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nginx - 1.4.6-1ubuntu3.4

---------------
nginx (1.4.6-1ubuntu3.4) trusty-security; urgency=medium

  * SECURITY UPDATE: multiple resolver security issues (LP: #1538165)
    - debian/patches/CVE-2016-074x-1.patch: fix possible segmentation fault
      on DNS format error.
    - debian/patches/CVE-2016-074x-2.patch: fix crashes in timeout handler.
    - debian/patches/CVE-2016-074x-3.patch: fixed CNAME processing for
      several requests.
    - debian/patches/CVE-2016-074x-4.patch: change the
      ngx_resolver_create_*_query() arguments.
    - debian/patches/CVE-2016-074x-5.patch: fix use-after-free memory
      accesses with CNAME.
    - debian/patches/CVE-2016-074x-6.patch: limited CNAME recursion.
    - CVE-2016-0742
    - CVE-2016-0743
    - CVE-2016-0744

 -- Marc Deslauriers <email address hidden> Wed, 03 Feb 2016 09:12:00 -0500

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release