atom feed9 messages in ru.sysoev.nginxIs nginx vulnerable to the Hash Table...
FromSent OnAttachments
Justin HartDec 31, 2011 10:37 am 
Maxim DouninDec 31, 2011 4:34 pm 
agentzhDec 31, 2011 9:53 pm 
Justin HartDec 31, 2011 9:58 pm 
agentzhJan 1, 2012 6:20 am 
Nginx UserJan 1, 2012 6:31 am 
Sergey A. OsokinJan 1, 2012 10:37 am 
agentzhJan 4, 2012 3:47 am 
Nginx UserJan 4, 2012 12:01 pm 
Subject:Is nginx vulnerable to the Hash Table Vulnerability (n.runs AG)?
From:Justin Hart (onyx@gmail.com)
Date:Dec 31, 2011 10:37:16 am
List:ru.sysoev.nginx

http://www.securityweek.com/hash-table-collision-attacks-could-trigger-ddos-massive-scale

Without going through the way nginx parses an incoming request, I'm unsure if nginx isn't vulnerable to this, because of the availability to grab the value of a GET parameter via http://wiki.nginx.org/HttpCoreModule#.24arg_PARAMETER. My hope is that especially if an $arg_PARAMETER isn't used in the config, it is not vulnerable because it wouldn't even attempt to parse the parameters, but I can't be sure.

Can anyone speak to this?

_______________________________________________ nginx mailing list ngi@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx