HAProxy "http_request_forward_body ()" Integer Overflow Vulnerability

HAProxy "http_request_forward_body ()" Integer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Haproxy 1.5.x
Description:
CVE (CAN) ID: CVE-2014-6269

HAProxy is a TCP/HTTP Load balancer.

In versions earlier than HAProxy 1.5.4, when processing the "start of value" variable in the HTTP message structure, the "http_request_forward_body ()" function (src/proto_http.c) has an integer overflow error, attackers can cause DoS attacks.

<* Source: James Dempsey
*>

Suggestion:
Vendor patch:

Haproxy
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://haproxy.1wt.eu/
Http://www.haproxy.org/download/1.5/src/CHANGELOG

Haproxy + Keepalived build Weblogic high-availability server Load balancer Cluster

Keepalived + HAProxy configure high-availability Load Balancing

Haproxy + Keepalived + Apache configuration notes in CentOS 6.3

Haproxy + KeepAlived WEB Cluster on CentOS 6

Haproxy + Keepalived build high-availability Load Balancing

For details about HAproxy, click here
HAproxy: click here

This article permanently updates the link address: