6

Our security department recently asked us to upgrade our servers in order to avoid possible attack caused by http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6214

Now, we have a lot of such servers, but all requests are proxied through one with NGINX. So, the question is, will it be enough to upgrade just this one?

As far as I understood, the vulnerability is present at the TCP level, if the TCP packages contain a special URG flag. Do I understand correctly, that NGINX works the following way as proxy:

  • Receives TCP packages and combines them as the HTTP request.
  • Chooses the appropriate back-end server to send it to.
  • Sends the request, generating it's own TCP packages, that are safe, and don't contain any vulnerable info? Or this is not the case, and NGINX simply resends the TCP packages it received?
Improve this question
3
  • I suspect you're correct. I would want to reproduce the issue on your current test server, then see if a kernel upgrade helps.
    – Tim
    Sep 18, 2017 at 6:16
  • This depends on the Nginx configuration, could you show the relevant config, omitting sensitive details if needed?
    – gxx
    Sep 18, 2017 at 8:26
  • 1
    Why not upgrade all the machines? I presume the OS you're running on them provides security updates, and I presume you're applying those security updates (perhaps in a staged rollout after testing)? Right?
    – marcelm
    Sep 18, 2017 at 12:48

1 Answer 1

Reset to default
8

Yes, when nginx is configured as a reverse proxy there is no direct TCP/IP connection between the clients and the back-end servers.

Nginx operates at layer 7 of the OSI model, the application layer and when it receives valid HTTP requests it will make it's own HTTP requests on behalf of clients to the appropriate back-end server. Remote clients can't manipulate what happens between nginx and the back-end servers at the TCP/IP level (layer 3/4 of the OSI model).

Improve this answer
3
  • 1
    This is not necessarily true. It depends on the configuration of Nginx. It's quite possible to do TCP / UDP proxying with the stream module.
    – gxx
    Sep 18, 2017 at 8:25
  • 1
    That's right, but we are not using it. So I guess upgrading just nginx would do it fine.
    – SPIRiT_1984
    Sep 18, 2017 at 8:44
  • @SPIRiT_1984 Alright, so you're good to go! Good luck!
    – gxx
    Sep 18, 2017 at 11:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .