Ubuntu 11.10 / 12.04 LTS / 12.10 : haproxy vulnerabilities (USN-1800-1)
Medium Nessus Plugin ID 65980
SynopsisThe remote Ubuntu host is missing a security-related patch.
DescriptionIt was discovered that HAProxy incorrectly handled configurations where global.tune.bufsize was set to a value higher than the default.
A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2012-2942)
Yves Lafon discovered that HAProxy incorrectly handled HTTP keywords in TCP inspection rules when HTTP keep-alive is enabled. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2013-1912).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected haproxy package.