[arch-security] [ASA-201507-3] haproxy: information leakage
rgacogne at archlinux.org
Sat Jul 4 13:00:17 UTC 2015
Arch Linux Security Advisory ASA-201507-3
Date : 2015-07-04
CVE-ID : CVE-2015-3281
Package : haproxy
Type : information leakage
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package haproxy before version 1.5.14-1 is vulnerable to information
Upgrade to 1.5.14-1.
# pacman -Syu "haproxy>=1.5.14-1"
The problem has been fixed upstream in version 1.5.14.
A vulnerability was found in the handling of HTTP pipelining. In some
cases, a client might be able to cause a buffer alignment issue and
retrieve uninitialized memory contents that exhibit data from a past
request or session.
With the proper timing and by requesting files of specific sizes from
the backend servers in HTTP pipelining mode, one can trigger a call to a
buffer alignment function which was not designed to work with pending
output data. The effect is that the output data pointer points to the
wrong location in the buffer, causing corruption on the client. It's
more visible with chunked encoding and compressed bodies because the
client cannot parse the response, but with a regular content-length
body, the client will simply retrieve corrupted contents. That's not the
worst problem in fact since pipelining is disabled in most clients.
The real problem is that it allows the client to sometimes retrieve data
from a previous session that remains in the buffer at the location where
the output pointer lies. Thus it's an information leak vulnerability.
A remote unauthenticated attacker can retrieve sensitive informations
from a previous session by sending crafted HTTP requests.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security