# Nginx security advisory (CVE-2013-2028)

**URL:** <https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772>\
**Category:** NGINX\
**Created:** [May 7, 2013, 1:31pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772 "2013-05-07T13:31:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [May 7, 2013, 1:31pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772/1 "2013-05-07T13:31:27Z")

</div>

Hello!

Greg MacManus, of iSIGHT Partners Labs, found a security problem  
in several recent versions of nginx. A stack-based buffer  
overflow might occur in a worker process while handling a  
specially crafted request, potentially resulting in arbitrary code  
execution (CVE-2013-2028).

The problem affects nginx 1.3.9 - 1.4.0.

The problem is fixed in nginx 1.5.0, 1.4.1.

Patch for the problem can be found here:

[http://nginx.org/download/patch.2013.chunked.txt](http://nginx.org/download/patch.2013.chunked.txt)

As a temporary workaround the following configuration  
can be used in each server{} block:

```
if ($http_transfer_encoding ~* chunked) {
    return 444;
}

```

–  
Maxim D.  
[http://nginx.org/en/donation.html](http://nginx.org/en/donation.html)

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [May 8, 2013, 4:36pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772/2 "2013-05-08T16:36:05Z")

</div>

Hello,

I use nginx 1.1.19, latest version from ubuntu repository.  
Anyone knows if Is it secure to use the latest verison from ubuntu  
repository?

thanks

Posted at Nginx Forum:

> **[Re: nginx security advisory (CVE-2013-2028)](https://forum.nginx.org/read.php?2,238946,239015#msg-239015)**
>
> Hello! Greg MacManus, of iSIGHT Partners Labs, found a security problem in several recent versions of nginx. A stack-based buffer overflow might occur in a worker process while handling a specially crafted request, potentially resulting in arbitrary...

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [May 8, 2013, 4:51pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772/3 "2013-05-08T16:51:52Z")

</div>

I would add to Patrick answer the following:

- 1.1.19 is a development version. IMHO it is always better to prefer  
stable in production environments. 1.2.8 or 1.4.1 depending on your  
needs/requirements.
- Check the changes from 1.2 or 1.4 [http://nginx.org/en/download.html](http://nginx.org/en/download.html)  
to  
decide what is better for you (there are only few security alerts, most  
of  
entries are bugfixes)
- Consider using nginx packages  
[http://nginx.org/en/linux\_packages.html](http://nginx.org/en/linux_packages.html)(available for Ubuntu), which  
will keep you nginx updates to the most  
recent version of your choice (stable or ‘mainline’ which I suppose is  
development? or maybe old-stable 1.2.8?) via aptitude

## Hope that’ll help

_B. R._

---

<div class="post-metadata">

**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\
**Post date:** [May 8, 2013, 4:43pm UTC](https://www.ruby-forum.com/t/nginx-security-advisory-cve-2013-2028/228772/4 "2013-05-08T16:43:41Z")

</div>

Hello,

the security leak is only affected in nginx 1.3.9 and 1.4.0. So just  
find  
out which version is currently in the ubuntu repository and decide if  
you  
can update or not.

Kind regards,  
Patrik

-----Ursprngliche Nachricht-----  
Von: removed\_email\_address@domain.invalid [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] Im Auftrag  
von  
jonas  
Gesendet: Mittwoch, 08. Mai 2013 16:36  
An: removed\_email\_address@domain.invalid  
Betreff: Re: nginx security advisory (CVE-2013-2028)

Hello,

I use nginx 1.1.19, latest version from ubuntu repository.  
Anyone knows if Is it secure to use the latest verison from ubuntu  
repository?

thanks

Posted at Nginx Forum:

> **[Re: nginx security advisory (CVE-2013-2028)](https://forum.nginx.org/read.php?2,238946,239015#msg-239015)**
>
> Hello! Greg MacManus, of iSIGHT Partners Labs, found a security problem in several recent versions of nginx. A stack-based buffer overflow might occur in a worker process while handling a specially crafted request, potentially resulting in arbitrary...

* * *

nginx mailing list  
removed\_email\_address@domain.invalid  
[http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)