Bug 1136552 (CVE-2014-6269)

Summary:	CVE-2014-6269 haproxy: remote client denial of service vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bleanhar, bperkins, carnil, ccoleman, cheese, dmcphers, jdetiber, jialiu, jkeck, jokerman, jrusnack, kseifried, lmeyer, mmcallis, mmccomas, mmcgrath, robinlee.sysu, rohara
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	haproxy 1.5.4	Doc Type:	Bug Fix
Doc Text:	A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-07 05:24:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1136698, 1138191, 1138193, 1139924
Bug Blocks:	1136553, 1146224

Description Vincent Danen 2014-09-02 21:16:10 UTC

A denial of service vulnerability was reported [1],[2] in HAProxy 1.5dev23 through to and including 1.5.3, and 1.6-dev.  A remote client could cause the HAProxy service to crash in specific conditions with a certain amount of server complicity (it must accept and slowly drain more than 2GB of data).  There is no possibility of code execution or loss of data integrity.

This is corrected in upstream version 1.5.4 [3].

[1] http://article.gmane.org/gmane.comp.web.haproxy/17726
[2] http://article.gmane.org/gmane.comp.web.haproxy/18097
[3] http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=b4d05093bc89f71377230228007e69a1434c1a0c

Comment 11 Murray McAllister 2014-09-10 03:09:22 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/09/09/18

Comment 12 Murray McAllister 2014-09-10 03:11:13 UTC

Created haproxy tracking bugs for this issue:

Affects: fedora-20 [bug 1139924]

Comment 15 Martin Prpič 2014-09-19 09:12:47 UTC

IssueDescription:

A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.

Comment 16 errata-xmlrpc 2014-09-24 05:24:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1292 https://rhn.redhat.com/errata/RHSA-2014-1292.html