CVE-2013-2175: Input Validation
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdrip or other "hdr" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAXHDRHISTORY variable.
Other sources
Willy Tarreau (w) reports:
Hi all,
a reproducible crash on latest haproxy snapshots was recently reported, and could finally be tracked down to a serious bug affecting all versions since 1.4.4.
The bug is in httpgethdr() in haproxy 1.5, or getipfromhdr2() in haproxy 1.4. If a configuration makes use of one of the following functions :
- hdrip(<name>, <value>) (in 1.4) - hdr(<name>, <value>) (in 1.5)
with a negative <value>, then the configuration risks to crash when the request contains exactly MAXHDRHISTORY values for the header <name>.
Note: "source 0.0.0.0 usesrc hdrip(<name>)" uses -1 by default for <value> and is vulnerable as well !
The quick workaround I can suggest before patching is to reject dangerous requests early using hdrcnt(<name>), which is available both in 1.4 and 1.5 :
block if { hdrcnt(<name>) ge 10 }
Thus, I'm going to issue 1.5-dev19 and 1.4.24 with the following patch applied. 1.5-dev has not received significant updates recently and is of very little risk when migrating from dev17 or dev18.
The new version will probably be finished during the week-end with an announce on Monday morning european time. It leaves enough time to finish testing the last snapshots.
If anyone has any concern with the fix, please discuss it on the list so that we can find a quick solution together.
I'll request a CVE ID for this bug after the release. If any of the subscribers has a list of spare CVE IDs, feel free to propose one before the release, that way I'll update the commit message to report it.
Best regards, Willy -
From 20d1c2cb1c6fcfe1f74a79f15573223701903834 Mon Sep 17 00:00:00 2001 From: Willy Tarreau <w> Date: Wed, 12 Jun 2013 22:27:44 +0200 Subject: BUG/CRITICAL: fix a possible crash when using negative header occurrences
When a config makes use of hdrip(x-forwarded-for,-1) or any such thing involving a negative occurrence count, the header is still parsed in the order it appears, and an array of up to MAXHDRHISTORY entries is created. When more entries are used, the entries simply wrap and continue this way.
A problem happens when the incoming header field count exactly divides MAXHDRHISTORY, because the computation removes the number of requested occurrences from the count, but does not care about the risk of wrapping with a negative number. Thus we can dereference the array with a negative number and randomly crash the process.
This bug has been present since the introduction of the negative offset count in 1.4.4 via commit bce70882. It has been reported by David Torgerson who offered some debugging traces showing where the crash happened, thus making it significantly easier to find the bug!
This fix must absolutely be backported to 1.4.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2175?
CVE-2013-2175 is classified as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2013-2175?
To mitigate CVE-2013-2175, update HAProxy to version 1.4.24 or later, or 1.5-dev19 or later.
What software is affected by CVE-2013-2175?
CVE-2013-2175 affects HAProxy versions 1.4 prior to 1.4.24 and 1.5 prior to 1.5-dev19, along with specific versions of Debian and Ubuntu.
What kind of attack does CVE-2013-2175 facilitate?
CVE-2013-2175 allows remote attackers to perform denial of service attacks by exploiting negative array indexes.
When was CVE-2013-2175 disclosed?
CVE-2013-2175 was disclosed on June 17, 2013.