Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-1292 advisory.

    [1.5.2-3]
    - Fix remote client denial of service vulnerability (#1138191)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications.

A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.
(CVE-2014-6269)

All haproxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

ID	Name	Product	Family	Severity
77847	Oracle Linux 7 : haproxy (ELSA-2014-1292)	Nessus	Oracle Linux Local Security Checks	high
77834	CentOS 7 : haproxy (CESA-2014:1292)	Nessus	CentOS Local Security Checks	medium
77815	RHEL 7 : haproxy (RHSA-2014:1292)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2014-6269

high

Tenable Plugins

high

medium

medium