{"id":5502,"date":"2018-11-09T10:28:41","date_gmt":"2018-11-09T02:28:41","guid":{"rendered":"https:\/\/aqzt.com\/?p=5502"},"modified":"2020-07-11T20:14:29","modified_gmt":"2020-07-11T12:14:29","slug":"nginx%e5%ae%89%e5%85%a8%e9%97%ae%e9%a2%98%e8%87%b4%e4%bd%bf1400%e5%a4%9a%e4%b8%87%e5%8f%b0%e6%9c%8d%e5%8a%a1%e5%99%a8%e6%98%93%e9%81%ad%e5%8f%97dos%e6%94%bb%e5%87%bb","status":"publish","type":"post","link":"https:\/\/aqzt.com\/5502.html","title":{"rendered":"Nginx\u5b89\u5168\u95ee\u9898\u81f4\u4f7f\u670d\u52a1\u5668\u6613\u906d\u53d7DoS\u653b\u51fb"},"content":{"rendered":"<p><a href=\"https:\/\/aqzt.com\/wp-content\/uploads\/2018\/11\/2018110902275032.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"500\" height=\"261\" class=\"aligncenter size-full wp-image-5503\" src=\"https:\/\/aqzt.com\/wp-content\/uploads\/2018\/11\/2018110902275032.jpg\" alt=\"\" \/><\/a><\/p>\n<p><a href=\"https:\/\/news.softpedia.com\/news\/nginx-security-issues-expose-more-than-14-million-servers-to-dos-attacks-523659.shtml\" target=\"_blank\" rel=\"noopener noreferrer\">\u636e\u5916\u5a92(softpedia)\u62a5\u9053<\/a>\uff0c\u8fd1\u65e5 nginx \u88ab\u7206\u51fa\u5b58\u5728\u5b89\u5168\u95ee\u9898\uff0c\u6709\u53ef\u80fd\u4f1a\u81f4\u4f7f 1400 \u591a\u4e07\u53f0\u670d\u52a1\u5668\u6613\u906d\u53d7 DoS \u653b\u51fb\u3002\u800c\u5bfc\u81f4\u5b89\u5168\u95ee\u9898\u7684\u6f0f\u6d1e\u5b58\u5728\u4e8e HTTP\/2 \u548c MP4 \u6a21\u5757\u4e2d\u3002<\/p>\n<p>nginx Web \u670d\u52a1\u5668\u4e8e11\u67086\u65e5\u53d1\u5e03\u4e86\u65b0\u7248\u672c\uff0c\u7528\u4e8e\u4fee\u590d\u5f71\u54cd 1.15.6, 1.14.1 \u4e4b\u524d\u7248\u672c\u7684\u591a\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u88ab\u53d1\u73b0\u7684\u5b89\u5168\u95ee\u9898\u6709\u4e00\u79cd\u8fd9\u6837\u7684\u60c5\u51b5 \u2014\u2014 \u5141\u8bb8\u6f5c\u5728\u7684\u653b\u51fb\u8005\u89e6\u53d1\u62d2\u7edd\u670d\u52a1(DoS)\u72b6\u6001\u5e76\u8bbf\u95ee\u654f\u611f\u7684\u4fe1\u606f\u3002<\/p>\n<p>\u201c\u5728 nginx HTTP\/2 \u5b9e\u73b0\u4e2d\u53d1\u73b0\u4e86\u4e24\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u8fc7\u591a\u7684\u5185\u5b58\u6d88\u8017(CVE-2018-16843)\u548cCPU\u4f7f\u7528\u7387(CVE-2018-16844)\u201d\uff0c\u8be6\u89c1 nginx \u7684\u5b89\u5168\u5efa\u8bae\u3002<\/p>\n<p>\u6b64\u5916\uff0c\u201c\u5982\u679c\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u4f7f\u7528&#8221;listen&#8221;\u6307\u4ee4\u7684&#8221;http2&#8243;\u9009\u9879\uff0c\u5219\u95ee\u9898\u4f1a\u5f71\u54cd\u4f7f\u7528 ngx_http_v2_module \u7f16\u8bd1\u7684 nginx\uff08\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u4e0d\u7f16\u8bd1\uff09\u3002\u201d<\/p>\n<p>\u4e3a\u4e86\u5229\u7528\u4e0a\u8ff0\u4e24\u4e2a\u95ee\u9898\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u53d1\u9001\u7279\u5236\u7684 HTTP\/2 \u8bf7\u6c42\uff0c\u8fd9\u5c06\u5bfc\u81f4\u8fc7\u591a\u7684CPU\u4f7f\u7528\u548c\u5185\u5b58\u4f7f\u7528\uff0c\u6700\u7ec8\u89e6\u53d1 DoS \u72b6\u6001\u3002<\/p>\n<p>\u6240\u6709\u8fd0\u884c\u672a\u6253\u4e0a\u8865\u4e01\u7684 nginx \u670d\u52a1\u5668\u90fd\u5bb9\u6613\u53d7\u5230 DoS \u653b\u51fb\u3002<\/p>\n<p>\u7b2c\u4e09\u4e2a\u5b89\u5168\u95ee\u9898(CVE-2018-16845)\u4f1a\u5f71\u54cd MP4 \u6a21\u5757\uff0c\u4f7f\u5f97\u653b\u51fb\u8005\u5728\u6076\u610f\u5236\u4f5c\u7684 MP4 \u6587\u4ef6\u7684\u5e2e\u52a9\u4e0b\uff0c\u5728 worker \u8fdb\u7a0b\u4e2d\u5bfc\u81f4\u51fa\u73b0\u65e0\u9650\u5faa\u73af\u3001\u5d29\u6e83\u6216\u5185\u5b58\u6cc4\u9732\u72b6\u6001\u3002<\/p>\n<p>\u6700\u540e\u4e00\u4e2a\u5b89\u5168\u95ee\u9898\u4ec5\u5f71\u54cd\u8fd0\u884c\u4f7f\u7528 ngx_http_mp4_module \u6784\u5efa\u7684 nginx \u7248\u672c\u5e76\u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u542f\u7528 mp4 \u9009\u9879\u7684\u670d\u52a1\u5668\u3002<\/p>\n<p>\u603b\u7684\u6765\u8bf4\uff0cHTTP\/2 \u6f0f\u6d1e\u5f71\u54cd 1.9.5 \u548c 1.15.5 \u4e4b\u95f4\u7684\u6240\u6709 nginx \u7248\u672c\uff0cMP4 \u6a21\u5757\u5b89\u5168\u95ee\u9898\u5f71\u54cd\u8fd0\u884c nginx 1.0.7, 1.1.3 \u53ca\u66f4\u9ad8\u7248\u672c\u7684\u670d\u52a1\u5668\u3002<\/p>\n<p>\u4e3a\u7f13\u89e3\u8fd9\u4e24\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u670d\u52a1\u5668\u7ba1\u7406\u5458\u5fc5\u987b\u5c06\u5176 nginx \u5347\u7ea7\u5230 1.14.1 stable \u62161.15.6 \u4e3b\u7ebf\u7248\u672c\u3002<\/p>\n<p><a href=\"https:\/\/aqzt.com\/wp-content\/uploads\/2018\/11\/2018110902280530.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1062\" height=\"977\" class=\"aligncenter size-full wp-image-5504\" src=\"https:\/\/aqzt.com\/wp-content\/uploads\/2018\/11\/2018110902280530.png\" alt=\"\" \/><\/a><\/p>\n<p>\u76ee\u524d\uff0cShodan \u641c\u7d22\u663e\u793a\u8d85\u8fc7 1400 \u4e07\u53f0\u670d\u52a1\u5668\u8fd0\u884c\u672a\u5305\u542b\u4fee\u590d\u8865\u4e01\u7684 nginx \u7248\u672c\uff08\u66f4\u786e\u5207\u5730\u8bf4\u662f 14,036,690 \u53f0\uff09\uff0c\u4ec5\u6709 6992 \u53f0\u670d\u52a1\u5668\u6253\u4e0a\u4e86\u5b89\u5168\u8865\u4e01\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u636e\u5916\u5a92(softpedia)\u62a5\u9053\uff0c\u8fd1\u65e5 nginx \u88ab\u7206\u51fa\u5b58\u5728\u5b89\u5168\u95ee\u9898\uff0c\u6709\u53ef\u80fd\u4f1a\u81f4\u4f7f 1400 \u591a\u4e07\u53f0\u670d\u52a1\u5668\u6613\u906d\u53d7 DoS \u653b\u51fb\u3002\u800c\u5bfc\u81f4\u5b89\u5168\u95ee\u9898\u7684\u6f0f\u6d1e\u5b58\u5728\u4e8e HTTP\/2 \u548c MP4 \u6a21\u5757\u4e2d\u3002 nginx Web \u670d\u52a1\u5668\u4e8e11\u67086\u65e5\u53d1\u5e03\u4e86\u65b0\u7248\u672c\uff0c\u7528\u4e8e\u4fee\u590d\u5f71\u54cd 1.15.6, 1.14.1 \u4e4b\u524d\u7248\u672c\u7684\u591a\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u88ab\u53d1\u73b0\u7684\u5b89\u5168\u95ee\u9898\u6709\u4e00\u79cd\u8fd9\u6837\u7684\u60c5\u51b5 \u2014\u2014 \u5141\u8bb8\u6f5c\u5728\u7684\u653b\u51fb\u8005\u89e6\u53d1\u62d2\u7edd\u670d\u52a1(DoS)\u72b6\u6001\u5e76\u8bbf\u95ee\u654f\u611f\u7684\u4fe1\u606f\u3002 \u201c\u5728 nginx HTTP\/2 \u5b9e\u73b0\u4e2d\u53d1\u73b0\u4e86\u4e24\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u8fc7\u591a\u7684\u5185\u5b58\u6d88\u8017(CVE-2018-1<\/p>\n","protected":false},"author":1,"featured_media":6522,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"footnotes":""},"categories":[27],"tags":[227,39,226],"collection":[276],"_links":{"self":[{"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/posts\/5502"}],"collection":[{"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/comments?post=5502"}],"version-history":[{"count":3,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/posts\/5502\/revisions"}],"predecessor-version":[{"id":6099,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/posts\/5502\/revisions\/6099"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/media\/6522"}],"wp:attachment":[{"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/media?parent=5502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/categories?post=5502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/tags?post=5502"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/aqzt.com\/wp-json\/wp\/v2\/collection?post=5502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}