CVE-2013-1912: Buffer Overflow

Published Apr 10, 2013

Updated

Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.

Affected Software

5 affected components

HAProxy HAProxy=1.4

HAProxy HAProxy=1.4.20

HAProxy HAProxy=1.4.22

HAProxy HAProxy=1.5-dev

HAProxy HAProxy=1.5-dev17

Event History

Apr 10, 2013

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1912?

CVE-2013-1912 has a severity rating that indicates it can lead to denial of service and potential remote code execution.

How do I fix CVE-2013-1912?

To fix CVE-2013-1912, upgrade HAProxy to version 1.4.23 or later or 1.5-dev18 or later.

What systems are affected by CVE-2013-1912?

CVE-2013-1912 affects HAProxy versions 1.4 through 1.4.22 and all 1.5-dev versions up to 1.5-dev17.

What type of vulnerability is CVE-2013-1912?

CVE-2013-1912 is classified as a buffer overflow vulnerability.

Can CVE-2013-1912 be exploited remotely?

Yes, CVE-2013-1912 can be exploited by remote attackers under specific circumstances.