oss-security - CVE Request -- fail2ban -- Use of insecure default temporary file when unbanning an IP (tmpfile = /tmp/fail2ban-mail.txt)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4DBA9AAC.5090708@redhat.com>
Date: Fri, 29 Apr 2011 13:02:04 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security <oss-security@...ts.openwall.com>,
        Cyril Jaquier: <cyril.jaquier@...l2ban.org>,
        Tomasz Papszun <tomek@...z.tpsa.pl>,
        Yaroslav Halchenko <debian@...russian.com>
Subject: CVE Request -- fail2ban -- Use of insecure default temporary file
 when unbanning an IP (tmpfile = /tmp/fail2ban-mail.txt)

Hello Josh, Steve, vendors,

   It was found that fail2ban IPs banner used insecure default temporary file
when unbanning an IP address. A local attacker could use this flaw to conduct
symlink attacks in order to gain access to sensitive information or potentially
to overwrite arbitrary file on the system.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=544232
[2] https://bugzilla.redhat.com/show_bug.cgi?id=700763

Patch applied by Debian distribution:
[3] http://git.onerussian.com/?p=deb/fail2ban.git;a=commitdiff;h=ea7d352616b1e2232fcaa99b11807a86ce29ed8b

Could you allocate a CVE id for this? (Note: It should CVE-2009-* identifier)

Thank you & Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.