[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

RE: [SECURITY] [DSA 2826-1] denyhosts security update



Good job keeping it professional.
Op 22 dec. 2013 21:09 schreef <reuben.finch@fluxradio.org>:
>
> I now have to help you.
>
> I am a mean coder and have been using computers since 1978.
>
> I will not go on IRC but you will remember me on Freenode or open projects
> as grumpydog
>
> What do you need? I patched Redhat I have a victim boxen here running debian
> plus another few running Slackware NetBSD hammered.
>
> Hiccup freenode Christel has had sex with virtually every oper.
>
> -----Original Message-----
> From: Yves-Alexis Perez [mailto:corsac@debian.org]
> Sent: 22 December 2013 18:26
> To: debian-security-announce@lists.debian.org
> Subject: [SECURITY] [DSA 2826-1] denyhosts security update
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-2826-1                   security@debian.org
> http://www.debian.org/security/                         Yves-Alexis Perez
> December 22, 2013                      http://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : denyhosts
> Vulnerability  : Remote denial of ssh service
> Problem type   : remote
> Debian-specific: no
> CVE ID         : CVE-2013-6890
>
> Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force
> attacks, could be used to perform remote denial of service against the SSH
> daemon. Incorrectly specified regular expressions used to detect brute force
> attacks in authentication logs could be exploited by a malicious user to
> forge crafted login names in order to make denyhosts ban arbitrary IP
> addresses.
>
> For the oldstable distribution (squeeze), this problem has been fixed in
> version 2.6-7+deb6u2.
>
> For the stable distribution (wheezy), this problem has been fixed in version
> 2.6-10+deb7u2.
>
> For the testing distribution (jessie), this problem has been fixed in
> version 2.6-10.1.
>
> For the unstable distribution (sid), this problem has been fixed in version
> 2.6-10.1.
>
> We recommend that you upgrade your denyhosts packages.
>
> Further information about Debian Security Advisories, how to apply these
> updates to your system and frequently asked questions can be found at:
> http://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.22 (GNU/Linux)
>
> iQEcBAEBCgAGBQJSty67AAoJEG3bU/KmdcClLHsH/08JpuJ82Zx+bIkahPHMDCgt
> KwIV0s8ZXWamBSbUflfsxY0KfhozWzzlIqqNfCE7M7VG4TNkctnSSBZdpqDKGypn
> eYuX/H3dPovLh4Srcx7TF3H9TW2/zv4uddn6xQYsWrKmhwDLcfZ/lR78TKZhnDZI
> 4fDP0hJ6qWdqE4kP+Qxt3hHxx1SYNJBm+tMaSJANlSaOjE5VPTmTlxf3b5u4bXez
> jbK73IGXitfDAjvyMePpPJSKrZ6juJTYU+/sOVV0yMJfik1cSJU5VwHAZjtQIk2g
> QqJFvVfWfqYR6wZIWUvONZI+5x0NvvFBXmjqyTbLb+5JzqKv2UwyVd19KEHvgjM=
> =GFt6
> -----END PGP SIGNATURE-----
>
>
> --
> To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
> Archive: http://lists.debian.org/20131222182611.GA24623@scapa.corsac.net
>
>
> --
> To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: [🔎] 002301ceff46$c4b47f00$4e1d7d00$@fluxradio.org">http://lists.debian.org/[🔎] 002301ceff46$c4b47f00$4e1d7d00$@fluxradio.org
>


Reply to: