[Bug 824710] New: Fail2Ban - Denial of Service in Apache rules - openSUSE Bugs

[Bug 824710] New: Fail2Ban - Denial of Service in Apache rules

older
[Bug 637176] New: Python doesn't...

bugzilla_noreply＠novell.com

13 Jun 2013 13 Jun '13

08:48

https://bugzilla.novell.com/show_bug.cgi?id=824710 https://bugzilla.novell.com/show_bug.cgi?id=824710#c0 Summary: Fail2Ban - Denial of Service in Apache rules Classification: openSUSE Product: openSUSE Factory Version: 13.1 Milestone 0 Platform: All OS/Version: openSUSE 12.3 Status: NEW Severity: Major Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: jweberhofer@weberhofer.at QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0 As also older versions are affected, the commit from https://github.com/fail2ban/fail2ban/pull/249 should be ported back to all supported versions OR all versions should be upgraded to the latest version. Johannes -------- Original Message -------- Subject: [Full-disclosure] Fail2ban 0.8.9, Denial of Service (Apache rules only) Date: Tue, 11 Jun 2013 11:58:51 +0200 From: Krzysztof Katowicz-Kowalewski To: full-disclosure@... Version 0.8.9 (latest) of Fail2ban allows to perform remote denial of service for arbitrary chosen IP address. Address listed on Fail2ban's whitelist are not affected. The vulnerability exists in Apache rules and it is caused by improper validation of a log file by regular expression. Malicious user can easily inject his own data to analyzed logs and deceive monitoring engine. Affected files: /filter.d/apache-auth.conf /filter.d/apache-nohome.conf /filter.d/apache-noscript.conf /filter.d/apache-overflows.conf Time frames: 01.06.2013 - Cyril Jaquier (contact section) has been informed about the vulnerability (no response) 08.06.2013 - The vulnerability has been released to the public. More information, including proof of concept and patches is available here: https://vndh.net/note:fail2ban-089-denial-service Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

13 Jun 13 Jun

08:50

New subject: [Bug 824710] Fail2Ban - Denial of Service in Apache rules

https://bugzilla.novell.com/show_bug.cgi?id=824710 https://bugzilla.novell.com/show_bug.cgi?id=824710#c Johannes Weberhofer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |maintenance@opensuse.org -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:20

New subject: [Bug 824710] VUL-0: fail2ban: DoS for arbitrary chosen IP addresses

https://bugzilla.novell.com/show_bug.cgi?id=824710 https://bugzilla.novell.com/show_bug.cgi?id=824710#c1 Alexander Bergmann changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |abergmann@suse.com InfoProvider|maintenance@opensuse.org | AssignedTo|bnc-team-screening@forge.pr |lnussel@suse.com |ovo.novell.com | Summary|Fail2Ban - Denial of |VUL-0: fail2ban: DoS for |Service in Apache rules |arbitrary chosen IP | |addresses --- Comment #1 from Alexander Bergmann 2013-06-13 08:20:06 UTC --- Only openSUSE is affected. openSUSE 12.2: based on 0.8.6 openSUSE 12.3: based on 0.8.8 The upstream fix can be found here: https://github.com/fail2ban/fail2ban/commit/6ccd57813cca617561fc67d2771361f3... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

22:00

New subject: [Bug 824710] VUL-0: fail2ban: DoS for arbitrary chosen IP addresses

https://bugzilla.novell.com/show_bug.cgi?id=824710 https://bugzilla.novell.com/show_bug.cgi?id=824710#c2 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium --- Comment #2 from Swamp Workflow Management 2013-06-13 16:00:10 UTC --- bugbot adjusting priority -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.