Ubuntu
nginx package

nginx vulnerable to MITM Attack [CVE-2011-4968]

  1. Raring (13.04)
  2. Bug #1098654
Bug #1098654 reported by Thomas Ward
260
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Nginx
Fix Released
Low
Unassigned
nginx (Debian)
Fix Released
Unknown
nginx (Ubuntu)
Fix Released
Low
Unassigned
Lucid
Won't Fix
Low
Unassigned
Oneiric
Won't Fix
Low
Unassigned
Precise
Won't Fix
Low
Unassigned
Quantal
Won't Fix
Low
Unassigned
Raring
Won't Fix
Low
Unassigned
Trusty
Won't Fix
Low
Unassigned
Utopic
Won't Fix
Low
Unassigned
Vivid
Won't Fix
Low
Unassigned
Wily
Fix Released
Low
Unassigned

Bug Description

I am reporting this bug so there's a bug to track this in within Launchpad. If/when a patch is approved upstream, this bug can be used as a reference point in the changelog when SRU-ing the fix into older releases.

Confirmed as Debian Bug 697940.
Confirmed as CVE-2011-4968.

This has already been added to the Ubuntu Security Team Tracker at http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-4968.html

Information as follows comes from the Debian Bug:
"When nginx is configured as a reverse proxy with an https origin server, it is vulnerable to a MITM attack, because it does not verify the certificate of the origin server.

This is upstream's bug https://trac.nginx.org/nginx/ticket/13, and also CVE-2011-4968.

It appears to have been known for over a year, but the proposed patches to resolve the problem appear to have never made it through the patch review process in upstream."

Sept. 10, 2015: This was 'fixed' upstream in nginx 1.7.0, with a commit landing upstream about 17 months ago. (see the changeset located at https://trac.nginx.org/nginx/changeset/060c2e692b96a150b584b8e30d596be1f2defa9c/nginx )

See original description

CVE References

Marc Deslauriers (mdeslaur)
Changed in nginx (Ubuntu Lucid):
status: New → Confirmed
Changed in nginx (Ubuntu Oneiric):
status: New → Confirmed
Changed in nginx (Ubuntu Precise):
status: New → Confirmed
Changed in nginx (Ubuntu Quantal):
status: New → Confirmed
Changed in nginx (Ubuntu Raring):
status: New → Confirmed
Changed in nginx (Ubuntu Lucid):
importance: Undecided → Low
Changed in nginx (Ubuntu Oneiric):
importance: Undecided → Low
Changed in nginx (Ubuntu Precise):
importance: Undecided → Low
Changed in nginx (Ubuntu Quantal):
importance: Undecided → Low
Changed in nginx (Ubuntu Raring):
importance: Undecided → Low
Bug Watch Updater (bug-watch-updater)
Changed in nginx (Debian):
status: Unknown → Confirmed
Revision history for this message
Thomas Ward (teward) wrote :

Oneiric has reached EOL (End of Life) and is no longer supported. As a result, this bug (against Oneiric) is being marked "Won't Fix". Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases.

Please feel free to report any other bugs you may find.

Changed in nginx (Ubuntu Oneiric):
status: Confirmed → Won't Fix
Revision history for this message
mik (therealmik) wrote :

I think this has been incorrectly classified as 'low'. People requiring secure connectivity to a backend server are currently receiving a silent downgrade in security.

Jamie Strandboge (jdstrand)
Changed in nginx (Ubuntu Raring):
status: Confirmed → Won't Fix
Revision history for this message
Thomas Ward (teward) wrote :

An upstream commit has been made addressing this issue.

Refer to http://trac.nginx.org/nginx/changeset/060c2e692b96a150b584b8e30d596be1f2defa9c/nginx for the fix.

I'll check if the other versions of nginx not listed here are affected later, after work.

Jamie Strandboge (jdstrand)
Changed in nginx (Ubuntu Quantal):
status: Confirmed → Won't Fix
Bug Watch Updater (bug-watch-updater)
Changed in nginx (Debian):
status: Confirmed → Fix Released
Revision history for this message
Thomas Ward (teward) wrote :

The nginx project tracker for this task was added to track the status in the PPAs. This has landed in the NGINX PPA for Mainline. It has not been backported to Stable at this time. (Was supposedly fixed in 1.7.0 per http://mailman.nginx.org/pipermail/nginx-devel/2015-February/006484.html)

Changed in nginx:
importance: Undecided → Low
status: New → Fix Released
Changed in nginx (Ubuntu Trusty):
importance: Undecided → Low
status: New → Confirmed
Changed in nginx (Ubuntu Utopic):
importance: Undecided → Low
status: New → Confirmed
Revision history for this message
Thomas Ward (teward) wrote :

Note on the 'severity' per comment #2: The severity set is based on the severity of the CVE, partly per the Security Team's tracker.

As this has been classified as "low" there, the severity here was set to "Low".

Revision history for this message
Rolf Leggewie (r0lf) wrote :

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

Changed in nginx (Ubuntu Lucid):
status: Confirmed → Won't Fix
Revision history for this message
Thomas Ward (teward) wrote :

Ubuntu Utopic has gone End of Life as of today. As such, this bug is being marked Won't Fix against the Utopic package.

Refer to: https://lists.ubuntu.com/archives/ubuntu-announce/2015-July/000198.html

Changed in nginx (Ubuntu Utopic):
status: Confirmed → Won't Fix
Revision history for this message
Thomas Ward (teward) wrote :

Ubuntu Wily has a fix for this included as part of the 1.9.3-1ubuntu1 merge. The fix for this issue was introduced in nginx 1.7.0.

Changed in nginx (Ubuntu Wily):
status: Confirmed → Fix Released
description: updated
Revision history for this message
Thomas Ward (teward) wrote :

Per the notes on the CVE tracker:

 sarnold> Backporting this fix is non-trivial and may break deployed
  applications. Someone who really wanted this could use stunnel as a
  work-around until 16.04 LTS is released.

This applies to Precise, Trusty, and Vivid.

Changed in nginx (Ubuntu Precise):
status: Confirmed → Won't Fix
Changed in nginx (Ubuntu Trusty):
status: Confirmed → Won't Fix
Changed in nginx (Ubuntu Vivid):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.