nginx 漏洞（适用于0.1.0-0.8.14）补丁

nginx 漏洞（适用于0.1.0-0.8.14）补丁

文章来源:http://xok.la/

漏洞介绍：
http://www.kb.cert.org/vuls/id/180065

As with a number of other web servers, nginx is designed to operate with a single privileged master process and multiple unprivileged worker processes handling specific requests. A remote, unauthenticated attacker may be able to execute arbitrary code in the context of the worker process or cause the worker process to crash, resulting in a denial of service.

补丁说明： http://sysoev.ru/nginx/patch.180065.txt

进入Nginx源码包，找到src/http/ngx_http_parse.c 文件，修改：

 

u -= 4;    
             if (u < r->uri.data) {    
                         return NGX_HTTP_PARSE_INVALID_REQUEST;    
                                                                }    
                     while (*(u - 1) != '/') {

为

u -= 5; 
        for ( ;; ) { 
             if (u < r->uri.data) { 
             return NGX_HTTP_PARSE_INVALID_REQUEST;
                                        } 
              if (*u == '/') { 
                                  u++; 
                                  break; 
                                }

然后重新编译。

官网补丁说明：

Index: src/http/ngx_http_parse.c
===================================================================
--- src/http/ngx_http_parse.c (revision 2410)
+++ src/http/ngx_http_parse.c (revision 2411)
@@ -1134,11 +1134,15 @@
#endif
                         case '/':
                                 state = sw_slash;
-                                u -= 4;
-                                if (u < r->uri.data) {
-                                        return NGX_HTTP_PARSE_INVALID_REQUEST;
-                                }
-                                while (*(u - 1) != '/') {
+                                u -= 5;
+                                for ( ;; ) {
+                                        if (u < r->uri.data) {
+                                                return NGX_HTTP_PARSE_INVALID_REQUEST;
+                                        }
+                                        if (*u == '/') {
+                                                u++;
+                                                break;
+                                        }
                                         u--;
                                 }
                                 break;