CVE-2016-0747: Medium severity apple xcode vulnerability
IDE Xcode Server. Multiple issues were addressed by updating nginx to version 1.21.0.
Other sources
The following flaw was found in the nginx resolver:
CNAME resolution was insufficiently limited, allowing an attacker who is able to trigger arbitrary name resolution to cause excessive resource consumption in worker processes.
This issue affects nginx only if the "resolver" directive is used in a configuration file.
The problems are fixed in nginx upstream versions 1.9.10 and 1.8.1.
External References:
http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html
— Red Hat
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
— MITRE
Credit
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-0747?
The severity of CVE-2016-0747 is medium with a severity value of 5.3.
How does CVE-2016-0747 affect Xcode Server?
CVE-2016-0747 affects Xcode Server by allowing remote attackers to cause a denial of service, resulting in worker process resource consumption.
How can I fix CVE-2016-0747 in Xcode Server?
To fix CVE-2016-0747 in Xcode Server, update nginx to version 1.21.0 or later.
Is there a remedy for CVE-2016-0747 in nginx?
Yes, there is a remedy for CVE-2016-0747 in nginx. Update nginx to version 1.9.10 or 1.8.1, depending on the affected version.
What is the canonical identifier for CVE-2016-0747?
The canonical identifier for CVE-2016-0747 is CVE-2016-0747.