新闻链接：1c8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3k6J5k6h3g2T1N6h3k6Q4x3X3g2U0L8$3#2Q4x3V1k6F1k6i4N6K6i4K6u0r3z5e0l9J5y4W2)9J5k6h3S2@1L8h3H3`.
新闻时间：2013-04-26
新闻正文：
奇虎360安全研究团队近日发现了nginx的一个严重漏洞，该漏洞存在于nginx的ngx_http_close_connection函数，攻击者可以构造r->count小于0或大于255恶意HTTP请求，该漏洞可能会远程执行任意代码，据360透露，目前影响nginx所有版本。
原文如下：
Website: 116K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4y4S2k6X3f1K6i4K6u0W2j5$3!0E0i4K6u0W2j5$3^5`.

I. BACKGROUND
---------------------

Nginx is an HTTP and reverse proxy server, as well as a mail proxy server, written by Igor Sysoev. For a long time, it has been running on many heavily loaded Russian sites including Yandex, Mail.Ru, VKontakte, and Rambler. According to Netcraft nginx served or proxied 12.96% busiest sites in April 2013. Here are some of the success stories: Netflix, WordPress.com, FastMail.FM.

II. DESCRIPTION
---------------------

Qihoo 360 Web Security Research Team discovered a critical vulnerability in nginx.

The vulnerability is caused by a int overflow error within the Nginx
ngx_http_close_connection function when r->count is less then 0 or more then 255, which could be exploited
by remote attackers to compromise a vulnerable system via malicious http requests.

III. AFFECTED PRODUCTS
---------------------------

Nginx all latest version

IV. Exploits/PoCs
---------------------------------------

In-depth technical analysis of the vulnerability and a fully functional remote code execution exploit are available through the safe3q (at) gmail (dot) com [email concealed]
In src\http\ngx_http_request_body.c ngx_http_discard_request_body function,we can make r->count++.

V. VUPEN Threat Protection Program
-----------------------------------

VI. SOLUTION
----------------

Validate the r->count input.

VII. CREDIT
--------------

This vulnerability was discovered by Safe3 of Qihoo 360.

VIII. ABOUT Qihoo 360
---------------------------

Qihoo 360 is the leading provider of defensive and offensive web cloud security of China.

IX. REFERENCES
----------------------

a3bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3&6Y4K9h3&6^5i4K6u0W2L8%4u0Y4i4K6u0r3k6h3&6Q4x3V1k6K6L8%4g2J5j5$3g2Q4b7K6u0Q4b7e0m8Z5N6s2c8H3i4K6y4m8i4K6u0r3i4K6u0r3M7r3q4U0K9$3g2@1M7%4c8G2M7X3#2K6k6h3y4#2M7X3W2@1P5g2)9J5k6h3y4G2L8g2)9J5c8X3k6A6L8r3g2K6i4K6u0r3x3e0t1I4y4o6p5$3i4K6u0r3L8X3N6A6L8Y4S2Q4x3X3c8A6L8Y4c8G2N6X3g2J5k6X3I4G2N6#2)9J5k6i4c8^5N6l9`.`.

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课