[Bug 824710] New: Fail2Ban - Denial of Service in Apache rules

https://bugzilla.novell.com/show_bug.cgi?id=824710 https://bugzilla.novell.com/show_bug.cgi?id=824710#c0 Summary: Fail2Ban - Denial of Service in Apache rules Classification: openSUSE Product: openSUSE Factory Version: 13.1 Milestone 0 Platform: All OS/Version: openSUSE 12.3 Status: NEW Severity: Major Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: jweberhofer@weberhofer.at QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0 As also older versions are affected, the commit from https://github.com/fail2ban/fail2ban/pull/249 should be ported back to all supported versions OR all versions should be upgraded to the latest version. Johannes -------- Original Message -------- Subject: [Full-disclosure] Fail2ban 0.8.9, Denial of Service (Apache rules only) Date: Tue, 11 Jun 2013 11:58:51 +0200 From: Krzysztof Katowicz-Kowalewski To: full-disclosure@... Version 0.8.9 (latest) of Fail2ban allows to perform remote denial of service for arbitrary chosen IP address. Address listed on Fail2ban's whitelist are not affected. The vulnerability exists in Apache rules and it is caused by improper validation of a log file by regular expression. Malicious user can easily inject his own data to analyzed logs and deceive monitoring engine. Affected files: /filter.d/apache-auth.conf /filter.d/apache-nohome.conf /filter.d/apache-noscript.conf /filter.d/apache-overflows.conf Time frames: 01.06.2013 - Cyril Jaquier (contact section) has been informed about the vulnerability (no response) 08.06.2013 - The vulnerability has been released to the public. More information, including proof of concept and patches is available here: https://vndh.net/note:fail2ban-089-denial-service Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.