Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Apr 2011 13:02:04 +0200
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>
CC: oss-security <>,
        Cyril Jaquier: <>,
        Tomasz Papszun <>,
        Yaroslav Halchenko <>
Subject: CVE Request -- fail2ban -- Use of insecure default temporary file
 when unbanning an IP (tmpfile = /tmp/fail2ban-mail.txt)

Hello Josh, Steve, vendors,

   It was found that fail2ban IPs banner used insecure default temporary file
when unbanning an IP address. A local attacker could use this flaw to conduct
symlink attacks in order to gain access to sensitive information or potentially
to overwrite arbitrary file on the system.


Patch applied by Debian distribution:

Could you allocate a CVE id for this? (Note: It should CVE-2009-* identifier)

Thank you & Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.