[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

RE: [SECURITY] [DSA 2826-1] denyhosts security update



I now have to help you.

I am a mean coder and have been using computers since 1978. 

I will not go on IRC but you will remember me on Freenode or open projects
as grumpydog 

What do you need? I patched Redhat I have a victim boxen here running debian
plus another few running Slackware NetBSD hammered.

Hiccup freenode Christel has had sex with virtually every oper.

-----Original Message-----
From: Yves-Alexis Perez [mailto:corsac@debian.org] 
Sent: 22 December 2013 18:26
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA 2826-1] denyhosts security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2826-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
December 22, 2013                      http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : denyhosts
Vulnerability  : Remote denial of ssh service
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2013-6890

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force
attacks, could be used to perform remote denial of service against the SSH
daemon. Incorrectly specified regular expressions used to detect brute force
attacks in authentication logs could be exploited by a malicious user to
forge crafted login names in order to make denyhosts ban arbitrary IP
addresses.

For the oldstable distribution (squeeze), this problem has been fixed in
version 2.6-7+deb6u2.

For the stable distribution (wheezy), this problem has been fixed in version
2.6-10+deb7u2.

For the testing distribution (jessie), this problem has been fixed in
version 2.6-10.1.

For the unstable distribution (sid), this problem has been fixed in version
2.6-10.1.

We recommend that you upgrade your denyhosts packages.

Further information about Debian Security Advisories, how to apply these
updates to your system and frequently asked questions can be found at:
http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBCgAGBQJSty67AAoJEG3bU/KmdcClLHsH/08JpuJ82Zx+bIkahPHMDCgt
KwIV0s8ZXWamBSbUflfsxY0KfhozWzzlIqqNfCE7M7VG4TNkctnSSBZdpqDKGypn
eYuX/H3dPovLh4Srcx7TF3H9TW2/zv4uddn6xQYsWrKmhwDLcfZ/lR78TKZhnDZI
4fDP0hJ6qWdqE4kP+Qxt3hHxx1SYNJBm+tMaSJANlSaOjE5VPTmTlxf3b5u4bXez
jbK73IGXitfDAjvyMePpPJSKrZ6juJTYU+/sOVV0yMJfik1cSJU5VwHAZjtQIk2g
QqJFvVfWfqYR6wZIWUvONZI+5x0NvvFBXmjqyTbLb+5JzqKv2UwyVd19KEHvgjM=
=GFt6
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
Archive: http://lists.debian.org/20131222182611.GA24623@scapa.corsac.net


Reply to: