# Buffer overflow CVE-2011-4315

**URL:** <https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819>\
**Category:** NGINX\
**Created:** [April 13, 2012, 12:11am UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819 "2012-04-13T00:11:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\
**Post date:** [April 13, 2012, 12:11am UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/1 "2012-04-13T00:11:23Z")

</div>

we are running nginx 0.8.54, I’m trying to pass PCI compliance testing  
they say this is vulnerable to a buffer overflow.

however when i try and find out if it is i can’t seem to find out.

[http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4315](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4315)

[http://www.securityfocus.com/bid/50710](http://www.securityfocus.com/bid/50710)

these links don’t show that my version has this flaw.

i’m hoping there is a link to show that this version is safe.

Thanks

Stephen

---

<div class="post-metadata">

**Author:** ![srveit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c67d28/32.png) [@srveit](https://www.ruby-forum.com/u/srveit)\
**Post date:** [April 13, 2012, 12:21am UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/2 "2012-04-13T00:21:06Z")

</div>

You are running a release which dates back to December 2010. The last  
relase in the 0.8 train is from July 2011, while CVE-2011-4315 was fixed  
in November 2011. You can assume your version is vulnerable.

If you can’t upgrade to current stable you will need to backport the  
bugfix to 0.8.

CVE-2011-4315 is missing on the nginx security advisories on [nginx.org](http://nginx.org),  
can someone add it?

BR,

Lukas

---

<div class="post-metadata">

**Author:** ![srveit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c67d28/32.png) [@srveit](https://www.ruby-forum.com/u/srveit)\
**Post date:** [April 13, 2012, 12:41am UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/3 "2012-04-13T00:41:32Z")

</div>

bummer. well thanks again

Stephen

---

<div class="post-metadata">

**Author:** ![srveit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c67d28/32.png) [@srveit](https://www.ruby-forum.com/u/srveit)\
**Post date:** [April 13, 2012, 12:16pm UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/4 "2012-04-13T12:16:25Z")

</div>

On Apr 13, 2012, at 2:20 AM, Lukas T. wrote:

> You are running a release which dates back to December 2010. The last relase in  
> the 0.8 train is from July 2011, while CVE-2011-4315 was fixed in November 2011.  
> You can assume your version is vulnerable.
> 
> If you can’t upgrade to current stable you will need to backport the bugfix to  
> 0.8.
> 
> CVE-2011-4315 is missing on the nginx security advisories on [nginx.org](http://nginx.org), can  
> someone add it?

Thanks for spotting it’s missing, we’ll add it.

---

<div class="post-metadata">

**Author:** ![srveit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c67d28/32.png) [@srveit](https://www.ruby-forum.com/u/srveit)\
**Post date:** [April 13, 2012, 1:11pm UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/5 "2012-04-13T13:11:42Z")

</div>

On Fri, Apr 13, 2012 at 01:04:56AM +0200, Lukas T. wrote:

> Here is the bugfix: [http://trac.nginx.org/nginx/changeset/4268/nginx](http://trac.nginx.org/nginx/changeset/4268/nginx)
> 
> Don’t know the patch can by applied 1:1 on 0.8 though.

The patch is suitable for 0.8.

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![srveit](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c67d28/32.png) [@srveit](https://www.ruby-forum.com/u/srveit)\
**Post date:** [April 13, 2012, 1:05am UTC](https://www.ruby-forum.com/t/buffer-overflow-cve-2011-4315/218819/6 "2012-04-13T01:05:47Z")

</div>

Here is the bugfix: [Changeset 4268:25ddf6afc0ff – nginx](http://trac.nginx.org/nginx/changeset/4268/nginx)

Don’t know the patch can by applied 1:1 on 0.8 though.