oss-security - Re: CVE Request -- fail2ban -- Use of insecure default temporary file when unbanning an IP (tmpfile = /tmp/fail2ban-mail.txt)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20110502192825.GA21926@rh.iggy.bress.home>
Date: Mon, 2 May 2011 15:29:29 -0400
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>, cyril.jaquier@...l2ban.org,
        Tomasz Papszun <tomek@...z.tpsa.pl>,
        Yaroslav Halchenko <debian@...russian.com>
Subject: Re: CVE Request -- fail2ban -- Use of insecure
 default temporary file when unbanning an IP (tmpfile =
 /tmp/fail2ban-mail.txt)

On Fri, Apr 29, 2011 at 01:02:04PM +0200, Jan Lieskovsky wrote:
> 
> Hello Josh, Steve, vendors,
> 
>   It was found that fail2ban IPs banner used insecure default temporary file
> when unbanning an IP address. A local attacker could use this flaw to conduct
> symlink attacks in order to gain access to sensitive information or potentially
> to overwrite arbitrary file on the system.
> 
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=544232
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=700763
> 
> Patch applied by Debian distribution:
> [3] http://git.onerussian.com/?p=deb/fail2ban.git;a=commitdiff;h=ea7d352616b1e2232fcaa99b11807a86ce29ed8b
> 
> Could you allocate a CVE id for this? (Note: It should CVE-2009-* identifier)
> 

Please use CVE-2009-5023

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.