Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2014-6269 First vendor Publication 2014-09-30
Vendor Cve Last vendor Modification 2014-10-02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6269

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:26516
 
Oval ID: oval:org.mitre.oval:def:26516
Title: ELSA-2014-1292 -- haproxy security update (Moderate)
Description: HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications. A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy. (CVE-2014-6269) All haproxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): ELSA-2014-1292
CVE-2014-6269
Version: 3
Platform(s): Oracle Linux 7
Product(s): haproxy
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26636
 
Oval ID: oval:org.mitre.oval:def:26636
Title: RHSA-2014:1292: haproxy security update (Moderate)
Description: HAProxy provides high availability, load balancing, and proxying for TCP and HTTP-based applications. A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy. (CVE-2014-6269) All haproxy users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): RHSA-2014:1292-00
CESA-2014:1292
CVE-2014-6269
Version: 3
Platform(s): Red Hat Enterprise Linux 7
CentOS Linux 7
Product(s): haproxy
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

Nessus® Vulnerability Scanner

Date Description
2014-09-25 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2014-1292.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-1292.nasl - Type : ACT_GATHER_INFO
2014-09-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1292.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=b4d05093bc89f7137723...
MLIST http://article.gmane.org/gmane.comp.web.haproxy/17726
http://article.gmane.org/gmane.comp.web.haproxy/18097
http://www.openwall.com/lists/oss-security/2014/09/09/23
REDHAT http://rhn.redhat.com/errata/RHSA-2014-1292.html
SECUNIA http://secunia.com/advisories/59936
http://secunia.com/advisories/61507

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2021-05-04 12:33:35
  • Multiple Updates
2021-04-22 01:40:21
  • Multiple Updates
2020-05-23 00:42:00
  • Multiple Updates
2016-04-27 01:08:46
  • Multiple Updates
2014-10-03 00:23:26
  • Multiple Updates
2014-10-02 09:23:44
  • Multiple Updates
2014-10-01 00:28:11
  • First insertion