Package: fail2ban Version: 0.8.3-2sid1 Severity: important The files /etc/fail2ban/action.d/mail-buffered.conf and /etc/fail2ban/action.d/sendmail-buffered.conf use file in the writable-for-all directory for appending text, i.e.
printf %%b "`date`: <ip> (<failures> failures)\n" >> <tmpfile> where tmpfile = /tmp/fail2ban-mail.txt Instead of that tmpfile definition, a unique filename should be used, e.g. by means of mktemp(1), like: tmpfile=`mktemp /tmp/f2ban-mail.txt.XXXXXXXXXX` which will safely create a file named like /tmp/f2ban-mail.txt.SsUtdRJQAg Currently, tmpfile is defined just once - at the starting of the script, if I understand the section [Init] correctly. As at the end of each execution of actionban the tmpfile is removed, simple replacing tmpfile definition with mktemp(1) in [Init] section won't do because now the filename is known and the attacker can create it. So probably, mktemp(1) should be used in the very definition of actionban, but as I don't know Python, I'm not trying to prepare the patch myself, sorry :-). -- System Information: Debian Release: 5.0.2 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Kernel: Linux 2.6.26-2-686 (SMP w/1 CPU core) Locale: LANG=C, LC_CTYPE=pl_PL.iso-8859-2 (charmap=ISO-8859-2) Shell: /bin/sh linked to /bin/bash Versions of packages fail2ban depends on: ii lsb-base 3.2-20 Linux Standard Base 3.2 init scrip ii python 2.5.2-3 An interactive high-level object-o ii python-central 0.6.8 register and build utility for Pyt Versions of packages fail2ban recommends: ii iptables 1.4.2-6 administration tools for packet fi ii whois 4.7.30 an intelligent whois client Versions of packages fail2ban suggests: ii bsd-mailx [mailx] 8.1.2-0.20071201cvs-3 A simple mail user agent ii mailx 1:20071201-3 Transitional package for mailx ren pn python-gamin <none> (no description available) -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
