NGINX Vulnerabilities in groov EPIC and RIO

Applies To:

Firmware for the following groov EPICs:

GRV-EPIC-PR1
GRV-EPIC-PR2

Firmware for the following groov RIOs:

GRV-R7-MM1001-10
GRV-R7-MM2001-10
GRV-R7-I1VAPM-3

Versions Affected:

All versions prior to 4.1.3

Resolved In Version:

4.1.3

Symptoms:

There are 4 different vulnerabilities in the NGINX software—which Opto 22 uses for user authentication—that could be exploited (when used in combination) by an unauthenticated attacker to remotely execute code:

Opto 22 has reviewed its product set for exposure to these vulnerabilities and determined that this vulnerability is restricted to users who have enabled Secure Shell (SSH) and manually modified NGINX configuration files or deployed custom web apps through the Linux shell.

Workaround:

If you used shell access to modify the configuration of NGINX, review any modifications made to the following modules and update them if they make these vulnerabilities exploitable:

ngx_http_rewrite_module
ngx_http_scgi_module
ngx_http_uwsgi_module
ngx_http_ssl_module
ngx_http_charset_module

Resolution:

Opto 22 has resolved this issue.

Questions?

Contact: Opto 22 Product Support.
Phone: 800-835-6786 or 951-695-3080
Email: support@opto22.com

DISCLAIMER

This Opto 22 Knowledge Base ('OptoKB') article is intended to provide general technical information on a particular subject or subjects and is not an exhaustive treatment of such subjects. Accordingly, the information in this OptoKB article is not intended to constitute application, design, software, or other professional engineering advice or services. Opto 22 may modify the OptoKB articles at any time. Before making any decision or taking any action which might affect your equipment, you should consult a qualified professional.

OPTO 22 DOES NOT WARRANT THE COMPLETENESS, TIMELINESS, OR ACCURACY OF THE DATA CONTAINED IN THIS OPTOKB ARTICLE AND MAY MAKE CHANGES THERETO AT ANY TIME AT ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS 'AS IS.' IN NO EVENT SHALL OPTO 22 BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT INCIDENTAL, CONSEQUENTIAL, LOSS PROFIT, OR DAMAGE, EVEN IF OPTO 22 HAS BEEN ADVISED ON THE POSSIBILITY OF SUCH DAMAGES.

OPTO 22 DISCLAIMS ALL WARRANTIES WHETHER EXPRESSED OR IMPLIED WITH RESPECT TO THE INFORMATION (INCLUDING HARDWARE, SOFTWARE, AND/OR FIRMWARE) PROVIDED HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTIBILITY, AND NON-INFRINGEMENT. Note that certain jurisdictions do not sanction the exclusion of implied warranties: thus, this disclaimer may not apply to you.