From: Raphael Marichez (falcogentoo.org)
Date: Sat Jul 28 2007 - 17:33:31 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200707-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Fail2ban: Denial of Service
      Date: July 28, 2007
      Bugs: #181214
        ID: 200707-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Fail2ban is vulnerable to a Denial of Service attack.

Background
==========

Fail2ban is a tool for parsing log files and banning IP addresses which
make too many password failures.

Affected packages
=================

    -------------------------------------------------------------------
     Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
  1 net-analyzer/fail2ban < 0.8.0-r1 >= 0.8.0-r1

Description
===========

A vulnerability has been discovered in Fail2ban when parsing log files.

Impact
======

A remote attacker could send specially crafted SSH login banners to the
vulnerable host, which would prevent any ssh connection to the host and
result in a Denial of Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Fail2ban users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-analyzer/fail2ban-0.8.0-r1"

References
==========

  [ 1 ] Original advisory
        http://www.ossec.net/en/attacking-loganalysis.html#fail2ban

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200707-13.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
securitygentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iQEVAwUBRqvEOzvRww8BFPxFAQLLaQgAmRtdO++rAMPruGjh4bpW0XfFMQgCa3we
FUKivMAmwkbgxQzMPwc9ou63Uxt949zVd0GnQgB/owGYmjAP0JKvzZgu0yoqBzx1
G5fh1wR3mMosQyoeHP9qXB7Bnuov6IupVggZOAEyumQ+17afovAmn+5UZLMkHQ0R
4K1MVFBrFy2yjPUGwW64Z9BLFaOoi4ZatOSKs5ABl4/a64FJAT14TlPOxJ6MD8uV
gAmx4TAC3S5ng/GuRA+DAcg50SY3Kzzf1oBROFKy220Bh2z/djbJ+9a6ydM3wwnq
zmVGRH35Ucye2qsMXZA7veaX0BhI6SHMG6xoXu/+KjWoTGLs8oR8AQ==
=YmWx
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]