（一）簡述： ? ?
? ? 早上收到nginx最新漏洞的通知，Nginx官方發布最新的安全公告，在Nginx范圍過濾器中發現了一個安全問題（CVE-2017-7529），通過精心構造的惡意請求可能會導致整數溢出并且不正確處理范圍，從而導致敏感信息泄漏。
當使用Nginx標準模塊時，如果文件頭從緩存返回響應，允許攻擊者獲取緩存文件頭。在某些配置中，緩存文件頭可能包含后端服務器IP地址或其他敏感信息。此外，如果使用第三方模塊有潛在的可能導致拒絕服務。
影響版本
Nginx 0.5.6-1.13.2
漏洞等級
中危
Nginx 在官方公告中稱發現了一個范圍過濾器中的安全問題。通過精心構造的惡意請
求能造成整數溢出，對范圍的不當處理會導致敏感信息泄漏。
No. ? ? ? ?漏洞名稱 ? ? ? ? ? 漏洞危害
CVE-2017-7529 ?Nginx range 過濾器整形溢出漏洞 ?高危
針對 CVE–2017–7529 修復建議
針對 Nginx range 過濾器整形溢出漏洞的修復建議
1) 下面的配置可以作為暫時的解決辦法：
max_ranges 1;
2) 建議受影響用戶盡快升級至 1.13.3, 1.12.1
3) 及時安裝官方補丁。
雖然臨時可以解決，不過還是建議升級到最新的版本，官方建議升級到1.12.1。
（二）具體的升級步驟：
?（1）升級和安裝nginx第三方模塊一樣，需要查看原來安裝nginx的版本以及編譯的參數：
[root@ittestserver1?opt]#?/usr/local/nginx2/sbin/nginx?-V nginx?version:?nginx/1.10.3 built?by?gcc?4.4.7?20120313?(Red?Hat?4.4.7-16)?(GCC)? built?with?OpenSSL?1.1.0e??16?Feb?2017 TLS?SNI?support?enabled configure?arguments:?--prefix=/usr/local/nginx2?--with-http_stub_status_module?--with-http_ssl_module?--with-http_realip_module?--with-http_gzip_static_module?--with-http_stub_status_module?--with-http_stub_status_module?--with-http_v2_module?--with-openssl=/tmp/install/openssl-1.1.0e?--with-http_v2_module
?（2）下載要升級的nginx版本
[root@ittestserver1?soft]#?wget?http://nginx.org/download/nginx-1.12.1.tar.gz --2017-07-17?15:41:24--??http://nginx.org/download/nginx-1.12.1.tar.gz 正在解析主機?nginx.org...?206.251.255.63,?95.211.80.227,?2001:1af8:4060:a004:21::e3,?... 正在連接?nginx.org|206.251.255.63|:80...?已連接。 已發出?HTTP?請求，正在等待回應...?200?OK 長度：981093?(958K)?[application/octet-stream] 正在保存至:?“nginx-1.12.1.tar.gz” 90%?[=================================================>?????]?892,302??????265K/s?eta(英國中部時100%[======================================================>]?981,093??????291K/s???in?3.3s???? 2017-07-17?15:41:28?(291?KB/s)?-?已保存?“nginx-1.12.1.tar.gz”?[981093/981093])
（3）解壓ningx下載的壓縮包編譯make,切記不要make install。
[root@ittestserver1?soft]#?tar?xf?nginx-1.12.1.tar.gz? [root@ittestserver1?soft]#?cd?nginx-1.12.1 [root@ittestserver1?nginx-1.12.1]#?ls auto??CHANGES??CHANGES.ru??conf??configure??contrib??html??LICENSE??man??README??src [root@ittestserver1?nginx-1.12.1]#?./configure??--prefix=/usr/local/nginx2?\ --with-http_stub_status_module?\ --with-http_ssl_module?\ --with-http_realip_module?\ --with-http_gzip_static_module?\ --with-http_stub_status_module?\ --with-http_stub_status_module?\ --with-http_v2_module?\ --with-openssl=/tmp/install/openssl-1.1.0e?\ --with-http_v2_module checking?for?OS+?Linux?2.6.32-358.el6.x86_64?x86_64 checking?for?C?compiler?...?found+?using?GNU?C?compiler+?gcc?version:?4.4.7?20120313?(Red?Hat?4.4.7-17)?(GCC)? checking?for?gcc?-pipe?switch?...?found checking?for?-Wl,-E?switch?...?found checking?for?gcc?builtin?atomic?operations?...?found checking?for?C99?variadic?macros?...?found checking?for?gcc?variadic?macros?...?found checking?for?gcc?builtin?64?bit?byteswap?...?found checking?for?unistd.h?...?found checking?for?inttypes.h?...?found checking?for?limits.h?...?found checking?for?sys/filio.h?...?not?found checking?for?sys/param.h?...?found checking?for?openat(),?fstatat()?...?found checking?for?getaddrinfo()?...?found checking?for?PCRE?library?...?found checking?for?PCRE?JIT?support?...?found checking?for?zlib?library?...?found creating?objs/Makefile Configuration?summary+?using?system?PCRE?library+?using?OpenSSL?library:?/tmp/install/openssl-1.1.0e+?using?system?zlib?librarynginx?path?prefix:?"/usr/local/nginx2"nginx?binary?file:?"/usr/local/nginx2/sbin/nginx"nginx?modules?path:?"/usr/local/nginx2/modules"nginx?configuration?prefix:?"/usr/local/nginx2/conf"nginx?configuration?file:?"/usr/local/nginx2/conf/nginx.conf"nginx?pid?file:?"/usr/local/nginx2/logs/nginx.pid"nginx?error?log?file:?"/usr/local/nginx2/logs/error.log"nginx?http?access?log?file:?"/usr/local/nginx2/logs/access.log"nginx?http?client?request?body?temporary?files:?"client_body_temp"nginx?http?proxy?temporary?files:?"proxy_temp"nginx?http?fastcgi?temporary?files:?"fastcgi_temp"nginx?http?uwsgi?temporary?files:?"uwsgi_temp"nginx?http?scgi?temporary?files:?"scgi_temp" [root@ittestserver1?nginx-1.12.1]#?make
由于make的時間比較長，需要稍等下。
（4）make編譯完后會在安裝目錄下生成一個objs目錄且在該目錄下有一個nginx執行文件。
[root@ittestserver1?nginx-1.12.1]#?ls auto?????CHANGES.ru??configure??html?????Makefile??objs????src CHANGES??conf????????contrib????LICENSE??man???????README [root@ittestserver1?nginx-1.12.1]#?ll?objs/ 總用量?7124 -rw-r--r--?1?root?root???17459?7月??17?15:48?autoconf.err -rw-r--r--?1?root?root???43530?7月??17?15:48?Makefile -rwxr-xr-x?1?root?root?7152312?7月??17?15:51?nginx -rw-r--r--?1?root?root????5345?7月??17?15:51?nginx.8 -rw-r--r--?1?root?root????7066?7月??17?15:48?ngx_auto_config.h -rw-r--r--?1?root?root?????657?7月??17?15:48?ngx_auto_headers.h -rw-r--r--?1?root?root????6242?7月??17?15:48?ngx_modules.c -rw-r--r--?1?root?root???38232?7月??17?15:51?ngx_modules.o drwxr-xr-x?9?root?root????4096?7月??17?15:48?src
（5）備份原來老的nginx文件
[root@ittestserver1?nginx-1.12.1]#?mv?/usr/local/nginx2/sbin/nginx?/usr/local/nginx2/sbin/nginx.bak [root@ittestserver1?nginx-1.12.1]#?cp?objs/nginx nginx????nginx.8?? [root@ittestserver1?nginx-1.12.1]#?cp?objs/nginx??/usr/local/nginx2/sbin/[root@ittestserver1?nginx-1.12.1]#?/usr/local/nginx2/sbin/nginx?-t nginx:?the?configuration?file?/usr/local/nginx2/conf/nginx.conf?syntax?is?ok nginx:?configuration?file?/usr/local/nginx2/conf/nginx.conf?test?is?successful
（6）使用make upgrade替換老的nginx進程
[root@ittestserver1 nginx-1.12.1]# make upgrade
/usr/local/nginx2/sbin/nginx -t
nginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful
kill -USR2 `cat /usr/local/nginx2/logs/nginx.pid`
sleep 1
test -f /usr/local/nginx2/logs/nginx.pid.oldbin
kill -QUIT `cat /usr/local/nginx2/logs/nginx.pid.oldbin`
（7）執行/usr/local/nginx2/sbin/nginx -V查看nginx最新的版本及編譯的參數
[root@ittestserver1?nginx-1.12.1]#?/usr/local/nginx2/sbin/nginx?-V nginx?version:?nginx/1.12.1 built?by?gcc?4.4.7?20120313?(Red?Hat?4.4.7-17)?(GCC)? built?with?OpenSSL?1.1.0e??16?Feb?2017 TLS?SNI?support?enabled configure?arguments:?--prefix=/usr/local/nginx2?--with-http_stub_status_module?--with-http_ssl_module?--with-http_realip_module?--with-http_gzip_static_module?--with-http_stub_status_module?--with-http_stub_status_module?--with-http_v2_module?--with-openssl=/tmp/install/openssl-1.1.0e?--with-http_v2_module
至此升級完成。
本文轉自 lqbyz 51CTO博客，原文鏈接:http://blog.51cto.com/liqingbiao/1948430
