Bug 824542 (CVE-2012-2942)

Summary:	CVE-2012-2942 haproxy: trash buffer overflow flaw can lead to arbitrary code execution
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ccoleman, jeremy, jlieskov, kseifried, robinlee.sysu, tkramer
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	haproxy 1.4.21	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-11 09:17:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	824544, 824545, 849288
Bug Blocks:	767033, 824547

Description Vincent Danen 2012-05-23 17:34:19 UTC

A flaw was reported [1] in HAProxy where, due to a boundary error when copying data into the trash buffer, an external attacker could cause a buffer overflow.  Exploiting this flaw could lead to the execution of arbitrary code, however it requires non-default settings for the global.tune.bufsize configuration option (must be set to a value greater than the default), and also that header rewriting is enabled (via, for example, the regrep or rsprep directives).

This flaw is reported against 1.4.20, prior versions may also be affected.  This has been fixed upstream in version 1.4.21 [2] and in git [3].

[1] https://secunia.com/advisories/49261/
[2] http://haproxy.1wt.eu/download/1.4/src/CHANGELOG
[3] http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b

Comment 1 Vincent Danen 2012-05-23 17:35:22 UTC

Created haproxy tracking bugs for this issue

Affects: fedora-all [bug 824544]
Affects: epel-all [bug 824545]

Comment 2 Kurt Seifried 2012-05-23 18:09:00 UTC

Added CVE as per http://www.openwall.com/lists/oss-security/2012/05/23/15

Comment 3 Jan Lieskovsky 2012-05-28 08:44:50 UTC

A duplicate CVE identifier of CVE-2012-2942 has been also assigned to this issue:
[4] http://www.openwall.com/lists/oss-security/2012/05/28/1

Comment 4 Jan Lieskovsky 2012-05-28 08:46:38 UTC

* Name: CVE-2012-2942
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2942 
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20120527
Category:
Reference: CONFIRM:http://haproxy.1wt.eu/#news 
Reference: CONFIRM:http://haproxy.1wt.eu/download/1.4/src/CHANGELOG 
Reference: CONFIRM:http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b 
Reference: BID:53647
Reference: URL:http://www.securityfocus.com/bid/53647 
Reference: SECUNIA:49261
Reference: URL:http://secunia.com/advisories/49261 
Reference: XF:haproxy-trash-bo(75777)
Reference: URL:http://xforce.iss.net/xforce/xfdb/75777 

Buffer overflow in the trash buffer in the header capture
functionality in HAProxy before 1.4.21, when global.tune.bufsize is
set to a value greater than the default and header rewriting is
enabled, allows remote attackers to cause a denial of service and
possibly execute arbitrary code via unspecified vectors.

Comment 5 Jan Lieskovsky 2012-08-17 10:55:52 UTC

The CVE-2012-2391 identifier has been rejected in favour of CVE-2012-2942:
--------------------------------------------------------------------------

Name: CVE-2012-2391
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2391 [Open URL]
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20120419
Category:
Reference: MLIST:[oss-security] 20120523 CVE request: haproxy trash buffer overflow flaw
Reference: URL:http://www.openwall.com/lists/oss-security/2012/05/23/12 
Reference: MLIST:[oss-security] 20120523 Re: CVE request: haproxy trash buffer overflow flaw
Reference: URL:http://www.openwall.com/lists/oss-security/2012/05/23/15 
Reference: MLIST:[oss-security] 20120528 Duplicate CVE identifiers (CVE-2012-2391 and CVE-2012-2942) assigned to HAProxy issue
Reference: URL:http://www.openwall.com/lists/oss-security/2012/05/28/1 

** REJECT **

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-2942. Reason:
This candidate is a duplicate of CVE-2012-2942. Notes: All CVE users
should reference CVE-2012-2942 instead of this candidate. All
references and descriptions in this candidate have been removed to
prevent accidental usage.

----------------------------------------------------------------------------

So the original haproxy flaw should reference CVE-2012-2942 (instead of CVE-2012-2391).

Comment 7 Fedora Update System 2012-10-16 03:44:21 UTC

haproxy-1.4.22-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2012-10-23 01:51:00 UTC

haproxy-1.4.22-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2012-10-23 01:56:33 UTC

haproxy-1.4.22-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2012-10-29 18:39:42 UTC

haproxy-1.4.22-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.