CVE-2013-2178 The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block....
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block arbitrary IP addresses via certain messages in a request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/fail2ban(Debian:12) | < 0.8.10-1 | 0.8.10-1 |
| debian/fail2ban(Debian:13) | < 0.8.10-1 | 0.8.10-1 |
| debian/fail2ban(Debian:14) | < 0.8.10-1 | 0.8.10-1 |
| fail2ban | <= 0.8.9 | No fix listed |
| fail2ban | = 0.1.0 | No fix listed |
| fail2ban | = 0.1.1 | No fix listed |
| fail2ban | = 0.1.2 | No fix listed |
| fail2ban | = 0.3.0 | No fix listed |
| fail2ban | = 0.3.1 | No fix listed |
| fail2ban | = 0.4.0 | No fix listed |
| fail2ban | = 0.4.1 | No fix listed |
| fail2ban | = 0.5.0 | No fix listed |
| fail2ban | = 0.5.1 | No fix listed |
| fail2ban | = 0.5.2 | No fix listed |
| fail2ban | = 0.5.3 | No fix listed |
| fail2ban | = 0.5.4 | No fix listed |
| fail2ban | = 0.5.5 | No fix listed |
| fail2ban | = 0.6.0 | No fix listed |
| fail2ban | = 0.6.1 | No fix listed |
| fail2ban | = 0.7.0 | No fix listed |
| fail2ban | = 0.7.1 | No fix listed |
| fail2ban | = 0.7.2 | No fix listed |
| fail2ban | = 0.7.3 | No fix listed |
| fail2ban | = 0.7.4 | No fix listed |
| fail2ban | = 0.7.5 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| fail2ban | = 0.7.6 | No fix listed |
| fail2ban | = 0.7.7 | No fix listed |
| fail2ban | = 0.7.8 | No fix listed |
| fail2ban | = 0.7.9 | No fix listed |
| fail2ban | = 0.8.0 | No fix listed |
| fail2ban | = 0.8.1 | No fix listed |
| fail2ban | = 0.8.2 | No fix listed |
| fail2ban | = 0.8.3 | No fix listed |
| fail2ban | = 0.8.4 | No fix listed |
| fail2ban | = 0.8.5 | No fix listed |
| fail2ban | = 0.8.6 | No fix listed |
| fail2ban | = 0.8.7 | No fix listed |
| fail2ban | = 0.8.7.1 | No fix listed |
| fail2ban | = 0.8.8 | No fix listed |
References
- Debian Security Tracker CVE-2013-2178 vendor-advisory
- openSUSE-SU-2014:0348 vendor-advisory
- DSA-2708 vendor-advisory
- [oss-security] 20130613 Re: Re: Fail2ban 0.8.9, Denial of Service (Apache rules only) mailing-list
- oval:org.mitre.oval:def:17338 signature vdb-entry
- raw.github.com
- vndh.net