早上收到nginx最新漏洞的通知，Nginx官方发布最新的安全公告，在Nginx范围过滤器中发现了一个安全问题（CVE-2017-7529），通过精心构造的恶意请求可能会导致整数溢出并且不正确处理范围，从而导致敏感信息泄漏。
当使用Nginx标准模块时，如果文件头从缓存返回响应，允许攻击者获取缓存文件头。在某些配置中，缓存文件头可能包含后端服务器IP地址或其他敏感信息。此外，如果使用第三方模块有潜在的可能导致拒绝服务。
影响版本
Nginx 0.5.6-1.13.2
漏洞等级
中危
Nginx 在官方公告中称发现了一个范围过滤器中的安全问题。通过精心构造的恶意请
求能造成整数溢出，对范围的不当处理会导致敏感信息泄漏。
No. 漏洞名称 漏洞危害
CVE-2017-7529 Nginx range 过滤器整形溢出漏洞 高危
针对 CVE–2017–7529 修复建议
针对 Nginx range 过滤器整形溢出漏洞的修复建议
下面的配置可以作为暂时的解决办法：
max_ranges 1;
建议受影响用户尽快升级至 1.13.3, 1.12.1
及时安装官方补丁。
虽然临时可以解决，不过还是建议升级到最新的版本，官方建议升级到1.12.1。
（1）升级和安装nginx第三方模块一样，需要查看原来安装nginx的版本以及编译的参数：
[root@ittestserver1 opt]# /usr/local/nginx2/sbin/nginx -Vnginx version: nginx/1.10.3built by gcc 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) built with OpenSSL 1.1.0e 16 Feb 2017TLS SNI support enabledconfigure arguments: --prefix=/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl=/tmp/install/openssl-1.1.0e --with-http_v2_module（2）下载要升级的nginx版本
[root@ittestserver1 soft]# wget http://nginx.org/download/nginx-1.12.1.tar.gz--2017-07-17 15:41:24-- http://nginx.org/download/nginx-1.12.1.tar.gz正在解析主机 nginx.org... 206.251.255.63, 95.211.80.227, 2001:1af8:4060:a004:21::e3, ...正在连接 nginx.org|206.251.255.63|:80... 已连接。已发出 HTTP 请求，正在等待回应... 200 OK长度：981093 (958K) [application/octet-stream]正在保存至: “nginx-1.12.1.tar.gz”90% [=================================================> ] 892,302 265K/s eta(英国中部时100%[======================================================>] 981,093 291K/s in 3.3s 2017-07-17 15:41:28 (291 KB/s) - 已保存 “nginx-1.12.1.tar.gz” [981093/981093])（3）解压ningx下载的压缩包编译make,切记不要make install。
[root@ittestserver1 soft]# tar xf nginx-1.12.1.tar.gz [root@ittestserver1 soft]# cd nginx-1.12.1[root@ittestserver1 nginx-1.12.1]# lsauto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src[root@ittestserver1 nginx-1.12.1]# ./configure --prefix=/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl=/tmp/install/openssl-1.1.0e --with-http_v2_modulechecking for OS + Linux 2.6.32-358.el6.x86_64 x86_64checking for C compiler ... found + using GNU C compiler + gcc version: 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) checking for gcc -pipe switch ... foundchecking for -Wl,-E switch ... foundchecking for gcc builtin atomic operations ... foundchecking for C99 variadic macros ... foundchecking for gcc variadic macros ... foundchecking for gcc builtin 64 bit byteswap ... foundchecking for unistd.h ... foundchecking for inttypes.h ... foundchecking for limits.h ... foundchecking for sys/filio.h ... not foundchecking for sys/param.h ... foundchecking for openat(), fstatat() ... foundchecking for getaddrinfo() ... foundchecking for PCRE library ... foundchecking for PCRE JIT support ... foundchecking for zlib library ... foundcreating objs/MakefileConfiguration summary + using system PCRE library + using OpenSSL library: /tmp/install/openssl-1.1.0e + using system zlib library nginx path prefix: "/usr/local/nginx2" nginx binary file: "/usr/local/nginx2/sbin/nginx" nginx modules path: "/usr/local/nginx2/modules" nginx configuration prefix: "/usr/local/nginx2/conf" nginx configuration file: "/usr/local/nginx2/conf/nginx.conf" nginx pid file: "/usr/local/nginx2/logs/nginx.pid" nginx error log file: "/usr/local/nginx2/logs/error.log" nginx http access log file: "/usr/local/nginx2/logs/access.log" nginx http client request body temporary files: "client_body_temp" nginx http proxy temporary files: "proxy_temp" nginx http fastcgi temporary files: "fastcgi_temp" nginx http uwsgi temporary files: "uwsgi_temp" nginx http scgi temporary files: "scgi_temp"[root@ittestserver1 nginx-1.12.1]# make由于make的时间比较长，需要稍等下。
（4）make编译完后会在安装目录下生成一个objs目录且在该目录下有一个nginx执行文件。
[root@ittestserver1 nginx-1.12.1]# lsauto CHANGES.ru configure html Makefile objs srcCHANGES conf contrib LICENSE man README[root@ittestserver1 nginx-1.12.1]# ll objs/总用量 7124-rw-r--r-- 1 root root 17459 7月 17 15:48 autoconf.err-rw-r--r-- 1 root root 43530 7月 17 15:48 Makefile-rwxr-xr-x 1 root root 7152312 7月 17 15:51 nginx-rw-r--r-- 1 root root 5345 7月 17 15:51 nginx.8-rw-r--r-- 1 root root 7066 7月 17 15:48 ngx_auto_config.h-rw-r--r-- 1 root root 657 7月 17 15:48 ngx_auto_headers.h-rw-r--r-- 1 root root 6242 7月 17 15:48 ngx_modules.c-rw-r--r-- 1 root root 38232 7月 17 15:51 ngx_modules.odrwxr-xr-x 9 root root 4096 7月 17 15:48 src（5）备份原来老的nginx文件
[root@ittestserver1 nginx-1.12.1]# mv /usr/local/nginx2/sbin/nginx /usr/local/nginx2/sbin/nginx.bak[root@ittestserver1 nginx-1.12.1]# cp objs/nginxnginx nginx.8 [root@ittestserver1 nginx-1.12.1]# cp objs/nginx /usr/local/nginx2/sbin/[root@ittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -tnginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful（6）使用make upgrade替换老的nginx进程
[root@ittestserver1 nginx-1.12.1]# make upgrade/usr/local/nginx2/sbin/nginx -tnginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is oknginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successfulkill -USR2 `cat /usr/local/nginx2/logs/nginx.pid`sleep 1test -f /usr/local/nginx2/logs/nginx.pid.oldbinkill -QUIT `cat /usr/local/nginx2/logs/nginx.pid.oldbin`（7）执行/usr/local/nginx2/sbin/nginx -V查看nginx最新的版本及编译的参数
[root@ittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -Vnginx version: nginx/1.12.1built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) built with OpenSSL 1.1.0e 16 Feb 2017TLS SNI support enabledconfigure arguments: --prefix=/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl=/tmp/install/openssl-1.1.0e --with-http_v2_module至此升级完成。
联系客服
