CVE-2006-6301 DenyHosts 2.5 does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to...
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
DenyHosts 2.5 does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a login name containing certain strings with an IP address, which is not properly handled by a regular expression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| denyhosts | = 2.5 | No fix listed |
References
- bugs.gentoo.org exploit
- 23236 third-party-advisory vendor-advisory
- 23603 third-party-advisory vendor-advisory
- GLSA-200701-01 vendor-advisory
- 21468 vdb-entry
- ADV-2006-4876 vdb-entry
- denyhosts-log-files-dos(30761) vdb-entry