Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.

Based on the version obtained for HAProxy, the remote host is running load balancing software that is potentially affected by a buffer overflow vulnerability when copying data into the trash buffer

Multiple security issues have been found in HAProxy, a load-balancing reverse proxy :

  - CVE-2012-2942     Buffer overflow in the header capture code.

  - CVE-2013-1912     Buffer overflow in the HTTP keepalive code.

  - CVE-2013-2175     Denial of service in parsing HTTP headers.

It was discovered that HAProxy incorrectly handled configurations where global.tune.bufsize was set to a value higher than the default.
A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2012-2942)

Yves Lafon discovered that HAProxy incorrectly handled HTTP keywords in TCP inspection rules when HTTP keep-alive is enabled. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2013-1912).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201301-02 (HAProxy: Arbitrary code execution)

    A boundary error in HAProxy could cause a buffer overflow when header       rewriting is enabled and the configuration sets global.tune.bufsize to a       value greater than the default (16384 bytes).
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Upstream security update

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upstream security release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Based on the self-reported version obtained from the HAProxy statistics reporting page, the remote host is running load balancing software that is potentially affected by a buffer overflow vulnerability when copying data into the trash buffer.

It may be possible for an attacker to exploit this vulnerability to execute arbitrary code on the remote host, but it requires that the global.tune.bufsize option is set to a value greater than default and that header rewriting is configured.

HAProxy reports :

A flaw was reported in HAProxy where, due to a boundary error when copying data into the trash buffer, an external attacker could cause a buffer overflow. Exploiting this flaw could lead to the execution of arbitrary code, however it requires non-default settings for the global.tune.bufsize configuration option (must be set to a value greater than the default), and also that header rewriting is enabled (via, for example, the regrep or rsprep directives). This flaw is reported against 1.4.20, prior versions may also be affected.

ID	Name	Product	Family	Severity
6900	HAProxy Trash Buffer Overflow Vulnerability	Nessus Network Monitor	Web Servers	medium
66936	Debian DSA-2711-1 : haproxy - several vulnerabilities	Nessus	Debian Local Security Checks	medium
65980	Ubuntu 11.10 / 12.04 LTS / 12.10 : haproxy vulnerabilities (USN-1800-1)	Nessus	Ubuntu Local Security Checks	medium
63436	GLSA-201301-02 : HAProxy: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
62658	Fedora 16 : haproxy-1.4.22-1.fc16 (2012-16056)	Nessus	Fedora Local Security Checks	medium
62657	Fedora 17 : haproxy-1.4.22-1.fc17 (2012-16033)	Nessus	Fedora Local Security Checks	medium
62552	Fedora 18 : haproxy-1.4.22-1.fc18 (2012-16023)	Nessus	Fedora Local Security Checks	medium
59798	HAProxy Trash Buffer Overflow Vulnerability	Nessus	Misc.	medium
59282	FreeBSD : haproxy -- buffer overflow (617959ce-a5f6-11e1-a284-0023ae8e59f0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-2942

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium