HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
BID:58820
Info
HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
| Bugtraq ID: | 58820 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2013-1912 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 03 2013 12:00AM |
| Updated: | Apr 13 2015 10:18PM |
| Credit: | Willy Tarreau |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Redhat OpenShift Enterprise 1.1.3 Redhat Enterprise Linux Load Balancer EUS 6.4.z Redhat Enterprise Linux Load Balancer 6 haproxy haproxy 1.4.22 haproxy haproxy 1.4.21 haproxy haproxy 1.4.20 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 |
| Not Vulnerable: |
haproxy haproxy 1.4.23 |
Discussion
HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
HAProxy is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffer.
An attacker may exploit this issue to execute arbitrary code or corrupt memory process. Failed exploits may result in denial-of-service conditions.
HAProxy versions prior to 1.4.23 are vulnerable.
HAProxy is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffer.
An attacker may exploit this issue to execute arbitrary code or corrupt memory process. Failed exploits may result in denial-of-service conditions.
HAProxy versions prior to 1.4.23 are vulnerable.
Exploit / POC
HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
HAProxy 'tcp-request content' CVE-2013-1912 Buffer Overflow Vulnerability
References:
References:
- BUG/CRITICAL: using HTTP information in tcp-request content may crash the proces (Willy Tarreau)
- CVE-2013-1912 : haproxy may crash on TCP content inspection rules (oss-sec)
- HAProxy Homepage (HAProxy)
- Bug 947581 -CVE-2013-1912 haproxy: rewrite rules flaw can lead to arbitrary code (Red Hat)
- haproxy security update (Red Hat)
- Moderate: haproxy security update (Red Hat)