CVE-2013-2028

Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

La función ngx_http_parse_chunked en http/ngx_http_parse.c en nginx v1.3.9 hasta v1.4.0 permite a atacantes remotos causar una denegación de servicio (caída) y ejecutar código arbitrario mediante una solicitud Transfer-Encoding (chunked) con un tamaño de chunk de gran longitud, lo que genera un error de "integer signedness" y un desbordamiento de búfer.

Nginx versions 1.3.9 through 1.4.0 suffer from a denial of service vulnerability.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-05-07 First Exploit
2013-05-08 CVE Published
2024-06-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (19)

URL	Tag	Source
http://secunia.com/advisories/55181	Third Party Advisory
http://www.osvdb.org/93037	Broken Link
http://www.securityfocus.com/bid/59699	Third Party Advisory
http://www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028	Broken Link
http://nginx.org/en/security_advisories.html

URL	Date	SRC
https://www.exploit-db.com/exploits/25499	2013-05-17
https://www.exploit-db.com/exploits/25775	2013-05-28
https://www.exploit-db.com/exploits/26737	2013-07-11
https://www.exploit-db.com/exploits/32277	2014-03-15
https://github.com/m4drat/CVE-2013-2028-Exploit	2020-06-27
https://github.com/Sunqiz/CVE-2013-2028-reproduction	2022-08-15
https://github.com/tachibana51/CVE-2013-2028-x64-bypass-ssp-and-pie-PoC	2019-08-03
http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html	2024-08-06
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/nginx_chunked_size.rb	2013-05-07

URL	Date	SRC
http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html	2021-11-10
http://nginx.org/download/patch.2013.chunked.txt	2021-11-10
https://github.com/rapid7/metasploit-framework/pull/1834	2021-11-10

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html	2021-11-10
http://security.gentoo.org/glsa/glsa-201310-04.xml	2021-11-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
F5 Search vendor "F5"		Nginx Search vendor "F5" for product "Nginx"				>= 1.3.9 <= 1.4.0 Search vendor "F5" for product "Nginx" and version " >= 1.3.9 <= 1.4.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				19 Search vendor "Fedoraproject" for product "Fedora" and version "19"		-		Affected