Date: Mon, 2 May 2011 15:29:29 -0400 From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, cyril.jaquier@...l2ban.org, Tomasz Papszun <tomek@...z.tpsa.pl>, Yaroslav Halchenko <debian@...russian.com> Subject: Re: CVE Request -- fail2ban -- Use of insecure default temporary file when unbanning an IP (tmpfile = /tmp/fail2ban-mail.txt) On Fri, Apr 29, 2011 at 01:02:04PM +0200, Jan Lieskovsky wrote: > > Hello Josh, Steve, vendors, > > It was found that fail2ban IPs banner used insecure default temporary file > when unbanning an IP address. A local attacker could use this flaw to conduct > symlink attacks in order to gain access to sensitive information or potentially > to overwrite arbitrary file on the system. > > References: >  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=544232 >  https://bugzilla.redhat.com/show_bug.cgi?id=700763 > > Patch applied by Debian distribution: >  http://git.onerussian.com/?p=deb/fail2ban.git;a=commitdiff;h=ea7d352616b1e2232fcaa99b11807a86ce29ed8b > > Could you allocate a CVE id for this? (Note: It should CVE-2009-* identifier) > Please use CVE-2009-5023 Thanks. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.