CVE-2009-2629: High severity nginx vulnerability
Published Sep 15, 2009
·Updated
Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.
Affected Software
10 affected components
F5 Nginx>=0.1.0<0.5.38
F5 Nginx>=0.6.0<0.6.39
F5 Nginx>=0.7.0<0.7.62
F5 Nginx>=0.8.0<0.8.15
Debian Debian Linux=5.0
Debian Debian Linux=4.0
Debian Debian Linux=6.0
Fedoraproject Fedora=11
Fedoraproject Fedora=10
Fedoraproject Fedora=12
Event History
Sep 15, 2009
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2629?
CVE-2009-2629 has a high severity due to the potential for remote attackers to execute arbitrary code.
2
How do I fix CVE-2009-2629?
To fix CVE-2009-2629, update nginx to versions 0.6.39, 0.7.62, 0.8.15 or later.
3
Which versions of nginx are affected by CVE-2009-2629?
CVE-2009-2629 affects nginx versions from 0.1.0 to 0.5.37, and several versions in the 0.6.x, 0.7.x, and 0.8.x series prior to specified patches.
4
Can CVE-2009-2629 be exploited remotely?
Yes, CVE-2009-2629 can be exploited remotely through crafted HTTP requests.
5
What type of vulnerability is CVE-2009-2629?
CVE-2009-2629 is a buffer underflow vulnerability.