PT-2015-1626 · Haproxy+3 · Haproxy+3

Charlie Smurthwaite · Published 2015-07-05 · Updated 2024-06-15 · CVE-2015-3281

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAProxy versions 1.5.x through 1.5.13 HAProxy version 1.6-dev

Description The issue is related to the buffer slow realign function, which does not properly realign a buffer used for pending outgoing data. This allows remote attackers to obtain sensitive information, specifically uninitialized memory contents of previous requests, via a crafted request.

Recommendations For HAProxy versions 1.5.x through 1.5.13, update to version 1.5.14 or later. For HAProxy version 1.6-dev, consider disabling the buffer slow realign function until a patch is available. As a temporary workaround, restrict access to sensitive information to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-10969

CESA-2015_1741

CVE-2015-3281

DSA-3301-1

OPENSUSE-SU-2015_1831-1

OPENSUSE-SU-2024:10114-1

RHSA-2015:1741

RHSA-2015:2666

RHSA-2015_1741

SUSE-SU-2015:1663-1

SUSE-SU-2015:1776-1

SUSE-SU-2015_1663-1

USN-2668-1

Affected Products

Centos

Haproxy

Red Hat

Suse

References · 61

• https://linux.oracle.com/errata/ELSA-2015-1741.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3281 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00023.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1741.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3301-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3281 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3281 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1663-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3281 · Security Note
• http://haproxy.org/news.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11042 · Security Note
• http://debian.org/security/2015/dsa-3301 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3301-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1776-1 · Vendor Advisory