Nginx [nginx-announce] nginx security advisory (CVE-2016-4450)

Hello!

A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted request
might result in worker process crash due to a NULL pointer dereference
while writing client request body to a temporary file (CVE-2016-4450).

The problem affects nginx 1.3.9 - 1.11.0.

---

The problem is fixed in nginx 1.11.1, 1.10.1.

Patch for nginx 1.9.13 - 1.11.0 can be found here:

http://nginx.org/download/patch.2016.write.txt

Patch for older nginx versions (1.3.9 - 1.9.12):

http://nginx.org/download/patch.2016.write2.txt


--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx-announce mailing list
nginx-announce@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-announce

Continue reading...

 

security update time

run centmin.sh menu option 4 and specify 1.11.1 to update yourself folks !

Code (Text):

./centmin.sh 

--------------------------------------------------------
     Centmin Mod Menu 123.09beta01 centminmod.com    
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu
12). Zend OpCache Install/Re-install
13). Install ioping.sh vbtechsupport.com/1239/
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2...
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Install/Re-Install
21). Update - Nginx + PHP-FPM + Siege
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 4
--------------------------------------------------------

Code (Text):

Do you want to run YUM install checks ?  [y/n]

This will increase your upgrade duration time wise.
Check the change log centminmod.com/changelog.html
to see if any Nginx or PHP related new additions
which require checking YUM prequisites are met.
If no new additions made, you can skip the 
YUM install check to speed up upgrade time.

 [y/n]: n
**********************************************************************
* Nginx Update script - Included in Centmin Extras
* Version: 1.2.3-eva2000.09.001 - Date: 30/04/2016 - Copyright 2011-2016 CentminMod.com
**********************************************************************

This software comes with no warranty of any kind. You are free to use
it for both personal and commercial use as licensed under the GPL.

Nginx Upgrade - Would you like to continue? [y/n] y

Install which version of Nginx? (version i.e. 1.11.1): 1.11.1

I'd update to latest code base for 123.09beta01 if possible via centmin.sh menu option 3 submenu option 3 if on 123.08stable or submenu option 2 if on 123.09beta01 first before running centmin.sh menu option 4

or via git pull on 123.09beta01 if you setup git environment

Code (Text):

cmdir
git pull
./centmin.sh

run menu option 4 and specify nginx 1.11.1

example git pull in /usr/local/src/centminmod will pull updates to your centmin mod code on your server

Code (Text):

git pull
remote: Counting objects: 4, done.
remote: Compressing objects: 100% (1/1), done.
remote: Total 4 (delta 3), reused 4 (delta 3), pack-reused 0
Unpacking objects: 100% (4/4), done.
From https://github.com/centminmod/centminmod
   118224a..a037290  123.09beta01 -> origin/123.09beta01
Updating 118224a..a037290
Fast-forward
inc/cpcheck.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

then run centmin.sh

 

maybe.. update to 1.11.1 ASAP !

 

manually update via

Code (Text):

cd /usr/local/src/centminmod
git pull
./centmin.sh

if /usr/local/src/centminmod is wiped during update, recreate it via below cmds which is the command line equivalent of centmin.sh menu option 23 submenu option 3 for switching to 123.09beta01 branch

Code (Text):

cd /usr/local/src
rm -rf /usr/local/src/centminmod
git clone https://github.com/centminmod/centminmod.git centminmod
cd centminmod
git checkout -f 123.09beta01
./centmin.sh

 

@trxerz

need git stash first if you manually edited local files prior

Code (Text):

cd /usr/local/src/centminmod
git stash
git pull
./centmin.sh

@Jimmy i pull version number from nginx read only github.com repo but that hasn't need updated beyond 1.10.1

 

haven't see any.. let me know if you do find some

 

fixed that Beta Branch - switch nginx version check from github releases to nginx.org download page | Centmin Mod Community

 

after menu option 23 steps, did you exit centmin.sh and change back into /usr/local/src/centminmod and re-run centmin.sh menu option 4 ? you need to do this otherwise you run option 4 against old code not the new updated code

 

probably your servers network connectivity to github.com or github is having issues GitHub System Status

GitHub System Status