这是个漏洞有点和前一段时间nginx FCGI路径传送bug有点类似，但是不一样。时间过去了快1个月，还是提醒下那些还没升级的朋友，抓紧！
2011.8.26 发现
影响版本:
nginx 0.5.*
nginx 0.6.*
nginx 0.7 <= 0.7.65
nginx 0.8 <= 0.8.37
漏洞描述:
Possible Arbitrary Code Execution with Null Bytes, PHP, and Old Versions of nginx
Ngnix在遇到%00空字节时与后端FastCGI处理不一致，导致可以在图片中嵌入PHP代码然后通过访问xxx.jpg%00.php来执行其中的代码
l临时处理# This location block will prevent an attacker from exploiting
# this vulnerability using files in the ‘uploads’ or ‘other_uploads’ directory
location ~ ^/(uploads|other_uploads)/.*.php$
{
deny all;
}
升级过程记录下
升级nginx到1.1.4 2011年9月20号发布
wget http://www.nginx.org/download/nginx-1.1.4.tar.gz
cp /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.bak
tar xvzf nginx-1.1.4.tar.gz
cd nginx-1.1.4
/usr/local/nginx/sbin/nginx -V
./configure *
make && make install
killall nginx && /usr/local/nginx/sbin/nginx