The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2666 advisory.

    OpenShift Enterprise by Red Hat is the company's cloud computing     Platform-as-a-Service (PaaS) solution designed for on-premise or     private cloud deployments.

    The following security issue is addressed with this release:

    An implementation error related to the memory management of request     and responses was found within HAProxy's buffer_slow_realign()     function. An unauthenticated remote attacker could use this flaw     to leak certain memory buffer contents from a past request or     session. (CVE-2015-3281)

    Space precludes documenting all of the bug fixes in this advisory. See     the OpenShift Enterprise Technical Notes, which will be updated     shortly for release 2.2.8, for details about these changes:

    https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-     single/Technical_Notes/index.html

    All OpenShift Enterprise 2 users are advised to upgrade to these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

haproxy was updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-3281: The buffer_slow_realign function in     HAProxy did not properly realign a buffer that is used     for pending outgoing data, which allowed remote     attackers to obtain sensitive information (uninitialized     memory contents of previous requests) via a crafted     request (bsc#937042).

  - Changed DH parameters to prevent Logjam attack.

These non-security issues were fixed :

  - BUG/MAJOR: buffers: make the buffer_slow_realign()     function respect output data

  - BUG/MINOR: ssl: fix smp_fetch_ssl_fc_session_id

  - MEDIUM: ssl: replace standards DH groups with custom     ones

  - BUG/MEDIUM: ssl: fix tune.ssl.default-dh-param value     being overwritten

  - MINOR: ssl: add a destructor to free allocated SSL     ressources

  - BUG/MINOR: ssl: Display correct filename in error     message

  - MINOR: ssl: load certificates in alphabetical order

  - BUG/MEDIUM: checks: fix conflicts between agent checks     and ssl healthchecks

  - BUG/MEDIUM: ssl: force a full GC in case of memory     shortage

  - BUG/MEDIUM: ssl: fix bad ssl context init can cause     segfault in case of OOM.

  - BUG/MINOR: ssl: correctly initialize ssl ctx for invalid     certificates

  - MINOR: ssl: add statement to force some ssl options in     global.

  - MINOR: ssl: add fetchs 'ssl_c_der' and 'ssl_f_der' to     return DER formatted certs

An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications.

An implementation error related to the memory management of requests and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session. (CVE-2015-3281)

All haproxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

An updated haproxy package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7. HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications.

An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated, remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session. (CVE-2015-3281)

Note that, according to CVE-2015-3281, this issue only exists in HAProxy version 1.5.x prior to 1.5.14. All HAProxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session. (CVE-2015-3281)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2015-1741 advisory.

    [1.5.4-4.1]
    - Fix buffer_slow_realign() function to respect output data (CVE-2015-3281, #1241537)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-3281

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that HAProxy incorrectly handled certain buffers. A remote attacker could possibly use this issue to obtain sensitive information belonging to previous requests.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

HAProxy reports :

A vulnerability was found when HTTP pipelining is used. In some cases, a client might be able to cause a buffer alignment issue and retrieve uninitialized memory contents that exhibit data from a past request or session. I want to address sincere congratulations to Charlie Smurthwaite of aTech Media for the really detailed traces he provided which made it possible to find the cause of this bug. Every user of 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev snapshot to fix this issue, or use the backport of the fix provided by their operating system vendors. CVE-2015-3281 was assigned to this bug.

Charlie Smurthwaite of aTech Media discovered a flaw in HAProxy, a fast and reliable load balancing reverse proxy, when HTTP pipelining is used. A client can take advantage of this flaw to cause data corruption and retrieve uninitialized memory contents that exhibit data from a past request or session.

ID	Name	Product	Family	Severity
119366	RHEL 6 : Red Hat OpenShift Enterprise 2.2.8 (RHSA-2015:2666)	Nessus	Red Hat Local Security Checks	high
86623	openSUSE Security Update : haproxy (openSUSE-2015-682)	Nessus	SuSE Local Security Checks	medium
86509	CentOS 6 / 7 : haproxy (CESA-2015:1741)	Nessus	CentOS Local Security Checks	medium
85977	RHEL 6 / 7 : haproxy 1.5 (RHSA-2015:1741)	Nessus	Red Hat Local Security Checks	medium
85866	Scientific Linux Security Update : haproxy on SL6.x, SL7.x i386/x86_64 (20150908)	Nessus	Scientific Linux Local Security Checks	medium
85864	Oracle Linux 7 : haproxy (ELSA-2015-1741)	Nessus	Oracle Linux Local Security Checks	high
85056	Fedora 22 : haproxy-1.5.14-1.fc22 (2015-11267)	Nessus	Fedora Local Security Checks	medium
85055	Fedora 21 : haproxy-1.5.14-1.fc21 (2015-11255)	Nessus	Fedora Local Security Checks	medium
84619	Ubuntu 14.10 / 15.04 : haproxy vulnerability (USN-2668-1)	Nessus	Ubuntu Local Security Checks	medium
84601	FreeBSD : haproxy -- information leak vulnerability (cbfa8bd7-24b6-11e5-86ff-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
84511	Debian DSA-3301-1 : haproxy - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-3281

high

Tenable Plugins

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium