Implemented Update NGINX for PCI Compliance

[Michael Menor]

We have a client that is failing their PCI scan due to Nginx running a "vulnerable" version. The remediation states that "This issue was fixed with the release of versions 1.15.6 and 1.14.1 of nginx. However, it is strongly recommended that the latest stable version with all of the appropriate patches be installed." The scan states that 3CX is running Nginx 1.12.1. We just updated their 3CX PBX to the latest stable release v15.5 Update 6, Build 15.5.15502.6

Reference: http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html

Vulnerability: Nginx ngx_http_mp4_module Information Disclosure Vulnerability

Severity: Medium

CVE: CVE-2018-16845 - https://nvd.nist.gov/vuln/detail/CVE-2018-16845

Description:
The version of nginx running on this host is prone to a vulnerability which might allow an attacker to cause an infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file.
The issue only affects nginx if it is built with the ngx_http_mp4_module, which is not built by default, and the "mp4" directive is used in
the configuration file. The attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

 

[florink]

Nginx in 3CX is not compiled with that module as far as I am aware. Also don't blindly trust those PCI (or other) scans. Many times those alerts are not based on valid information but only on speculations based on the software version detected.

 

[Benedikt Machens]

Check it with 2>&1 nginx -V | tr ' ' '\n' | grep _module

The MP4 module is not part of it

 

[Michael Menor]

Thank you for the input, I'll try to dispute that finding with the auditors to see it they'll "pass" it.