Test ID:	1.3.6.1.4.1.25623.1.0.112420
Category:	Web Servers
Title:	nginx 1.1.3 - 1.15.5 Denial of Service and Memory Disclosure via mp4 module
Summary:	A security issue was identified in the ngx_http_mp4_module, which might; allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result; in worker process memory disclosure by using a specially crafted mp4 file.
Description:	Summary: A security issue was identified in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. Vulnerability Insight: The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the 'mp4' directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module. Affected Software/OS: nginx versions 1.1.3 through 1.15.5. Solution: Update nginx to version 1.15.6 or later. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-16845 BugTraq ID: 105868 http://www.securityfocus.com/bid/105868 Debian Security Information: DSA-4335 (Google Search) https://www.debian.org/security/2018/dsa-4335 http://seclists.org/fulldisclosure/2021/Sep/36 http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html https://lists.debian.org/debian-lts-announce/2018/11/msg00010.html RedHat Security Advisories: RHSA-2018:3652 https://access.redhat.com/errata/RHSA-2018:3652 RedHat Security Advisories: RHSA-2018:3653 https://access.redhat.com/errata/RHSA-2018:3653 RedHat Security Advisories: RHSA-2018:3680 https://access.redhat.com/errata/RHSA-2018:3680 RedHat Security Advisories: RHSA-2018:3681 https://access.redhat.com/errata/RHSA-2018:3681 http://www.securitytracker.com/id/1042039 SuSE Security Announcement: openSUSE-SU-2019:2120 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html https://usn.ubuntu.com/3812-1/
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.