[arch-security] [ASA-201606-11] haproxy: denial of service

[Levente Polyak]

Arch Linux Security Advisory ASA-201606-11
==========================================

Severity: Medium
Date    : 2016-06-10
CVE-ID  : CVE-2016-5360
Package : haproxy
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package haproxy before version 1.6.5-4 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 1.6.5-4.

# pacman -Syu "haproxy>=1.6.5-4"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

A problem has been discovered with the new field "rule_deny_status"
into struct http_txn, which is filled only by actions "http-request
deny" and "http-request tarpit". It's then used in the deny code path
to emit the proper error message, but is used uninitialized when the
deny comes from a "reqdeny" rule, causing random behaviours ranging
from returning a 200, an empty response, or crashing the process.

Impact
======

A remote attacker is able to use a specially crafted request to crash
the process resulting in denial of service.

References
==========

https://access.redhat.com/security/cve/CVE-2016-5360
http://www.openwall.com/lists/oss-security/2016/06/09/5
https://bugs.archlinux.org/task/49638

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160610/74756516/attachment.asc>