（一）简述：
早上收到nginx最新漏洞的通知，Nginx官方发布最新的安全公告，在Nginx范围过滤器中发现了一个安全问题（CVE-2017-7529），通过精心构造的恶意请求可能会导致整数溢出并且不正确处理范围，从而导致敏感信息泄漏。
当使用Nginx标准模块时，如果文件头从缓存返回响应，允许攻击者获取缓存文件头。在某些配置中，缓存文件头可能包含后端服务器IP地址或其他敏感信息。此外，如果使用第三方模块有潜在的可能导致拒绝服务。
影响版本
Nginx 0.5.6-1.13.2
漏洞等级
中危
Nginx 在官方公告中称发现了一个范围过滤器中的安全问题。通过精心构造的恶意请
求能造成整数溢出，对范围的不当处理会导致敏感信息泄漏。
No. 漏洞名称 漏洞危害
CVE-2017-7529 Nginx range 过滤器整形溢出漏洞 高危
针对 CVE–2017–7529 修复建议
针对 Nginx range 过滤器整形溢出漏洞的修复建议
1) 下面的配置可以作为暂时的解决办法：
max_ranges 1;
2) 建议受影响用户尽快升级至 1.13.3, 1.12.1
3) 及时安装官方补丁。
虽然临时可以解决，不过还是建议升级到最新的版本，官方建议升级到1.12.1。
（二）具体的升级步骤：
（1）升级和安装nginx第三方模块一样，需要查看原来安装nginx的版本以及编译的参数：
[root@ittestserver1 opt]# /usr/local/nginx2/sbin/nginx -V nginx version: nginx/1.10.3 built by gcc 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) built with OpenSSL 1.1.0e 16 Feb 2017 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl=/tmp/install/openssl-1.1.0e --with-http_v2_module
（2）下载要升级的nginx版本
[root@ittestserver1 soft]# wget http://nginx.org/download/nginx-1.12.1.tar.gz --2017-07-17 15:41:24-- http://nginx.org/download/nginx-1.12.1.tar.gz 正在解析主机 nginx.org... 206.251.255.63, 95.211.80.227, 2001:1af8:4060:a004:21::e3, ... 正在连接 nginx.org|206.251.255.63|:80... 已连接。 已发出 HTTP 请求，正在等待回应... 200 OK 长度：981093 (958K) [application/octet-stream] 正在保存至: “nginx-1.12.1.tar.gz” 90% [=================================================> ] 892,302 265K/s eta(英国中部时100%[======================================================>] 981,093 291K/s in 3.3s 2017-07-17 15:41:28 (291 KB/s) - 已保存 “nginx-1.12.1.tar.gz” [981093/981093])
（3）解压ningx下载的压缩包编译make,切记不要make install。
[root@ittestserver1 soft]# tar xf nginx-1.12.1.tar.gz [root@ittestserver1 soft]# cd nginx-1.12.1 [root@ittestserver1 nginx-1.12.1]# ls auto CHANGES CHANGES.ru conf configure contrib html LICENSE man README src [root@ittestserver1 nginx-1.12.1]# ./configure --prefix=/usr/local/nginx2 \ --with-http_stub_status_module \ --with-http_ssl_module \ --with-http_realip_module \ --with-http_gzip_static_module \ --with-http_stub_status_module \ --with-http_stub_status_module \ --with-http_v2_module \ --with-openssl=/tmp/install/openssl-1.1.0e \ --with-http_v2_module checking for OS + Linux 2.6.32-358.el6.x86_64 x86_64 checking for C compiler ... found + using GNU C compiler + gcc version: 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) checking for gcc -pipe switch ... found checking for -Wl,-E switch ... found checking for gcc builtin atomic operations ... found checking for C99 variadic macros ... found checking for gcc variadic macros ... found checking for gcc builtin 64 bit byteswap ... found checking for unistd.h ... found checking for inttypes.h ... found checking for limits.h ... found checking for sys/filio.h ... not found checking for sys/param.h ... found checking for openat(), fstatat() ... found checking for getaddrinfo() ... found checking for PCRE library ... found checking for PCRE JIT support ... found checking for zlib library ... found creating objs/Makefile Configuration summary + using system PCRE library + using OpenSSL library: /tmp/install/openssl-1.1.0e + using system zlib library nginx path prefix: "/usr/local/nginx2" nginx binary file: "/usr/local/nginx2/sbin/nginx" nginx modules path: "/usr/local/nginx2/modules" nginx configuration prefix: "/usr/local/nginx2/conf" nginx configuration file: "/usr/local/nginx2/conf/nginx.conf" nginx pid file: "/usr/local/nginx2/logs/nginx.pid" nginx error log file: "/usr/local/nginx2/logs/error.log" nginx http access log file: "/usr/local/nginx2/logs/access.log" nginx http client request body temporary files: "client_body_temp" nginx http proxy temporary files: "proxy_temp" nginx http fastcgi temporary files: "fastcgi_temp" nginx http uwsgi temporary files: "uwsgi_temp" nginx http scgi temporary files: "scgi_temp" [root@ittestserver1 nginx-1.12.1]# make
由于make的时间比较长，需要稍等下。
（4）make编译完后会在安装目录下生成一个objs目录且在该目录下有一个nginx执行文件。
[root@ittestserver1 nginx-1.12.1]# ls auto CHANGES.ru configure html Makefile objs src CHANGES conf contrib LICENSE man README [root@ittestserver1 nginx-1.12.1]# ll objs/ 总用量 7124 -rw-r--r-- 1 root root 17459 7月 17 15:48 autoconf.err -rw-r--r-- 1 root root 43530 7月 17 15:48 Makefile -rwxr-xr-x 1 root root 7152312 7月 17 15:51 nginx -rw-r--r-- 1 root root 5345 7月 17 15:51 nginx.8 -rw-r--r-- 1 root root 7066 7月 17 15:48 ngx_auto_config.h -rw-r--r-- 1 root root 657 7月 17 15:48 ngx_auto_headers.h -rw-r--r-- 1 root root 6242 7月 17 15:48 ngx_modules.c -rw-r--r-- 1 root root 38232 7月 17 15:51 ngx_modules.o drwxr-xr-x 9 root root 4096 7月 17 15:48 src
（5）备份原来老的nginx文件
[root@ittestserver1 nginx-1.12.1]# mv /usr/local/nginx2/sbin/nginx /usr/local/nginx2/sbin/nginx.bak [root@ittestserver1 nginx-1.12.1]# cp objs/nginx nginx nginx.8 [root@ittestserver1 nginx-1.12.1]# cp objs/nginx /usr/local/nginx2/sbin/ [root@ittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -t nginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful
（6）使用make upgrade替换老的nginx进程
[root@ittestserver1 nginx-1.12.1]# make upgrade
/usr/local/nginx2/sbin/nginx -t
nginx: the configuration file /usr/local/nginx2/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx2/conf/nginx.conf test is successful
kill -USR2 `cat /usr/local/nginx2/logs/nginx.pid`
sleep 1
test -f /usr/local/nginx2/logs/nginx.pid.oldbin
kill -QUIT `cat /usr/local/nginx2/logs/nginx.pid.oldbin`
（7）执行/usr/local/nginx2/sbin/nginx -V查看nginx最新的版本及编译的参数
[root@ittestserver1 nginx-1.12.1]# /usr/local/nginx2/sbin/nginx -V nginx version: nginx/1.12.1 built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) built with OpenSSL 1.1.0e 16 Feb 2017 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx2 --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_stub_status_module --with-http_v2_module --with-openssl=/tmp/install/openssl-1.1.0e --with-http_v2_module
至此升级完成。
本文转自 lqbyz 51CTO博客，原文链接:http://blog.51cto.com/liqingbiao/1948430
