CVE-2007-4323: DenyHosts DoS vulnerability

Debian Bug report logs - #438162
CVE-2007-4323: DenyHosts DoS vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2007-4323: DenyHosts DoS vulnerability

Date: Wed, 15 Aug 2007 21:00:45 +0200

Package: denyhosts
Version: 2.6-1
Severity: grave
Tags: security
Justification: user security hole

>From CVE-2007-4323:
"DenyHosts 2.6 does not properly parse sshd log files, which allows
remote attackers to add arbitrary hosts to the /etc/hosts.deny file
and cause a denial of service by adding arbitrary IP addresses to the
sshd log file, as demonstrated by logging in via ssh with a client
protocol version identification containing an IP address string, a
different vector than CVE-2006-6301."

Please mention the CVE id in the changelog.

Message #10 received at 438162@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 438162@bugs.debian.org

Subject: Re: CVE-2007-4323: DenyHosts DoS vulnerability

Date: Thu, 16 Aug 2007 02:50:40 +0200

[Message part 1 (text/plain, inline)]

Hi,
I intend to upload an NMU to fix this problem, attached is a
patch which should fix CVE-2007-4323
I know its a bit early for an NMU announce but I thought it 
might be useful since it also includes a patch for the 
problem. So feel free to use it and upload yourself.

The patch is also archived on:
http://people.debian.org/~nion/nmu-diff/denyhosts-2.6-2_2.6-2.1.patch

Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[denyhosts-2.6-2_2.6-2.1.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #15 received at 438162-close@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 438162-close@bugs.debian.org

Subject: Bug#438162: fixed in denyhosts 2.6-2.1

Date: Fri, 17 Aug 2007 12:47:04 +0000

Source: denyhosts
Source-Version: 2.6-2.1

We believe that the bug you reported is fixed in the latest version of
denyhosts, which is due to be installed in the Debian FTP archive:

denyhosts_2.6-2.1.diff.gz
  to pool/main/d/denyhosts/denyhosts_2.6-2.1.diff.gz
denyhosts_2.6-2.1.dsc
  to pool/main/d/denyhosts/denyhosts_2.6-2.1.dsc
denyhosts_2.6-2.1_all.deb
  to pool/main/d/denyhosts/denyhosts_2.6-2.1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 438162@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Golde <nion@debian.org> (supplier of updated denyhosts package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Thu, 16 Aug 2007 02:41:59 +0200
Source: denyhosts
Binary: denyhosts
Architecture: source all
Version: 2.6-2.1
Distribution: unstable
Urgency: high
Maintainer: Marco Bertorello <marco@bertorello.ns0.it>
Changed-By: Nico Golde <nion@debian.org>
Description: 
 denyhosts  - an utility to help sys admins thwart ssh hackers
Closes: 438162
Changes: 
 denyhosts (2.6-2.1) unstable; urgency=high
 .
   * Non-maintainer upload for testing security team
   * Included 07_fix_CVE-2007-4323.dpatch to fix
     CVE-2007-4323 (Closes: #438162).
Files: 
 a04e227f2332ad4696ee40a764ccd9e5 713 net optional denyhosts_2.6-2.1.dsc
 4e537f64be9aa32414a3f03722bdcc31 33975 net optional denyhosts_2.6-2.1.diff.gz
 ae56cd77766be74a7b731ac5350299fb 62784 net optional denyhosts_2.6-2.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGw5/yHYflSXNkfP8RAosUAKCsoUMbMD5scAfZKi5V1eWYNwA4CQCeIwCR
ZQz2rC8O0AYDFpfSBVOnGP8=
=QqN0
-----END PGP SIGNATURE-----

Message #20 received at 438162@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <atomo64@gmail.com>

To: 438162@bugs.debian.org

Cc: control@bugs.debian.org, Nico Golde <nion@debian.org>

Subject: Reopening: package in etch is still vulnerable

Date: Sun, 7 Oct 2007 21:38:43 -0500

[Message part 1 (text/plain, inline)]

reopen 438162 =
tags 438162 etch
thanks

Package version in etch is 2.6-1 which is affected.

-- 
Atomo64 - Raphael

Please avoid sending me Word, PowerPoint or Excel attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html

[signature.asc (application/pgp-signature, inline)]

Message #29 received at 438162@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Raphael Geissert <atomo64@gmail.com>, 438162@bugs.debian.org

Cc: 438162-done@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#438162: Reopening: package in etch is still vulnerable

Date: Mon, 8 Oct 2007 11:11:13 +0200

[Message part 1 (text/plain, inline)]

found 438162 2.6-1
fixed 438162 2.6-2.1
thanks

Hi Raphael,
* Raphael Geissert <atomo64@gmail.com> [2007-10-08 11:04]:
> reopen 438162 =
> tags 438162 etch
> thanks
> 
> Package version in etch is 2.6-1 which is affected.

I closed this bug again, there is no need to keep it open, 
that's what we have version tracking for.
Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #43 received at 438162-close@bugs.debian.org (full text, mbox, reply):

From: Martin Zobel-Helas <zobel@debian.org>

To: 438162-close@bugs.debian.org

Subject: Bug#438162: fixed in denyhosts 2.6-1etch4

Date: Sat, 26 Jan 2008 19:52:14 +0000

Source: denyhosts
Source-Version: 2.6-1etch4

We believe that the bug you reported is fixed in the latest version of
denyhosts, which is due to be installed in the Debian FTP archive:

denyhosts_2.6-1etch4.diff.gz
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4.diff.gz
denyhosts_2.6-1etch4.dsc
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4.dsc
denyhosts_2.6-1etch4_all.deb
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 438162@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Zobel-Helas <zobel@debian.org> (supplier of updated denyhosts package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 26 Jan 2008 00:19:15 +0100
Source: denyhosts
Binary: denyhosts
Architecture: source all
Version: 2.6-1etch4
Distribution: stable
Urgency: low
Maintainer: Marco Bertorello <marco@bertorello.ns0.it>
Changed-By: Martin Zobel-Helas <zobel@debian.org>
Description: 
 denyhosts  - an utility to help sys admins thwart ssh hackers
Closes: 438162
Changes: 
 denyhosts (2.6-1etch4) stable; urgency=low
 .
   * Non-maintainer upload by SRM
   * Included 07_fix_CVE-2007-4323.dpatch to fix
     CVE-2007-4323 (Closes: #438162).
Files: 
 cf66b8e39f3744f7484a02320c6c96a4 719 net optional denyhosts_2.6-1etch4.dsc
 313d73176594555196c0088d8d1a70a9 33801 net optional denyhosts_2.6-1etch4.diff.gz
 f39aa3b7fffda9c8f41e2b051550e3dd 62434 net optional denyhosts_2.6-1etch4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHmnqqST77jl1k+HARAqMTAJwKZagENZuZFBaMPIZSV+TSlX9GcwCg3Lna
Yz9whkJMG7iq+gbMtnLG4JA=
=Bynn
-----END PGP SIGNATURE-----

Message #48 received at 438162-close@bugs.debian.org (full text, mbox, reply):

From: Martin Zobel-Helas <zobel@debian.org>

To: 438162-close@bugs.debian.org

Subject: Bug#438162: fixed in denyhosts 2.6-1etch4

Date: Sat, 16 Feb 2008 12:17:04 +0000

Source: denyhosts
Source-Version: 2.6-1etch4

We believe that the bug you reported is fixed in the latest version of
denyhosts, which is due to be installed in the Debian FTP archive:

denyhosts_2.6-1etch4.diff.gz
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4.diff.gz
denyhosts_2.6-1etch4.dsc
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4.dsc
denyhosts_2.6-1etch4_all.deb
  to pool/main/d/denyhosts/denyhosts_2.6-1etch4_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 438162@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Zobel-Helas <zobel@debian.org> (supplier of updated denyhosts package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 26 Jan 2008 00:19:15 +0100
Source: denyhosts
Binary: denyhosts
Architecture: source all
Version: 2.6-1etch4
Distribution: stable
Urgency: low
Maintainer: Marco Bertorello <marco@bertorello.ns0.it>
Changed-By: Martin Zobel-Helas <zobel@debian.org>
Description: 
 denyhosts  - an utility to help sys admins thwart ssh hackers
Closes: 438162
Changes: 
 denyhosts (2.6-1etch4) stable; urgency=low
 .
   * Non-maintainer upload by SRM
   * Included 07_fix_CVE-2007-4323.dpatch to fix
     CVE-2007-4323 (Closes: #438162).
Files: 
 cf66b8e39f3744f7484a02320c6c96a4 719 net optional denyhosts_2.6-1etch4.dsc
 313d73176594555196c0088d8d1a70a9 33801 net optional denyhosts_2.6-1etch4.diff.gz
 f39aa3b7fffda9c8f41e2b051550e3dd 62434 net optional denyhosts_2.6-1etch4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHmnqqST77jl1k+HARAqMTAJwKZagENZuZFBaMPIZSV+TSlX9GcwCg3Lna
Yz9whkJMG7iq+gbMtnLG4JA=
=Bynn
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.