Arch Linux Security Advisory ASA-201606-11
=========================================
Severity: Medium
Date    : 2016-06-10
CVE-ID  : CVE-2016-5360
Package : haproxy
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package haproxy before version 1.6.5-4 is vulnerable to denial of
service.

Resolution
=========
Upgrade to 1.6.5-4.

# pacman -Syu "haproxy>=1.6.5-4"

The problem has been fixed upstream but no release is available yet.

Workaround
=========
None.

Description
==========
A problem has been discovered with the new field "rule_deny_status"
into struct http_txn, which is filled only by actions "http-request
deny" and "http-request tarpit". It's then used in the deny code path
to emit the proper error message, but is used uninitialized when the
deny comes from a "reqdeny" rule, causing random behaviours ranging
from returning a 200, an empty response, or crashing the process.

Impact
=====
A remote attacker is able to use a specially crafted request to crash
the process resulting in denial of service.

References
=========
https://access.redhat.com/security/cve/CVE-2016-5360
https://www.openwall.com/lists/oss-security/2016/06/09/5
https://bugs.archlinux.org/task/49638