3CX Server Failed PCI Vuln Audit

[Angel Montejano]

Hi Team,

We recently had a Vulnerabilyt Audit and our 3CX servers failed due to the following:

"The remote web server is affected by a data disclosure vulnerability."

The provided Solution the Aduditor gave us is the next one:

"Either apply the patch manually or upgrade to nginx 1.12.1 / 1.13.3 or later."

My question was, Is it possible to update the Nginx version of the webserver, without affecting the PBX services ?

Our Current version for servers are:

3CX Vresion: 18.0 (Build 965)
Running on:
OS Name: Microsoft Windows Server 2016 Standard
OS Version: 10.0.14393 N/A Build 14393

Your help and expertise will be much appreciated.

 

[Nathan@Voxtelesys]

Firstly, it doesn't look like your 3CX is up to date.

I believe a 3CX update will also update NGINX (or at least it is handled that way in the Debian Linux installs of 3CX).

Latest 3CX version: 18.0 Update 5 (Build 418) and is using nginx version 1.14.2 on Linux installs, your mileage may vary on your Windows Install of 3CX. Maybe someone else can speak to the nginx version being packaged with the Windows 3CX installer.

You can check with nginx -v

Is it possible to update the Nginx version of the webserver, without affecting the PBX services ?

Are you hopping to do it without restarting PBX services or are you asking if a newer mainline nginx version is compatible with the rest of the 3CX services/config?

If it is the first option, any sort of restart to Nginx will affect 3CX webclient users (and the management console), IIRC.

I would start with an update through the 3CX Management Console after hours and go from there. (Pst. take a backup before hand )

I hope this helps!

 

[Chris-MBN]

3CX on Windows version 18.0 (Build 418) uses nginx version 1.18.0

 

[Angel Montejano]

3CX on Windows version 18.0 (Build 418) uses nginx version 1.18.0

I will run an update tonight and have check if this solves the problem.

Thank you