ID CVE-2012-5642
Summary server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
References
Vulnerable Configurations
  • Fail2Ban 0.8.7.1
    cpe:2.3:a:fail2ban:fail2ban:0.8.7.1
  • Fail2Ban 0.8.7
    cpe:2.3:a:fail2ban:fail2ban:0.8.7
  • Fail2Ban 0.8.6
    cpe:2.3:a:fail2ban:fail2ban:0.8.6
  • Fail2Ban 0.8.5
    cpe:2.3:a:fail2ban:fail2ban:0.8.5
  • Fail2Ban 0.8.4
    cpe:2.3:a:fail2ban:fail2ban:0.8.4
  • Fail2Ban 0.8.3
    cpe:2.3:a:fail2ban:fail2ban:0.8.3
  • Fail2Ban 0.8.2
    cpe:2.3:a:fail2ban:fail2ban:0.8.2
  • Fail2Ban 0.8.1
    cpe:2.3:a:fail2ban:fail2ban:0.8.1
  • Fail2Ban 0.8.0
    cpe:2.3:a:fail2ban:fail2ban:0.8.0
  • Fail2Ban 0.7.9
    cpe:2.3:a:fail2ban:fail2ban:0.7.9
  • Fail2Ban 0.7.8
    cpe:2.3:a:fail2ban:fail2ban:0.7.8
  • Fail2Ban 0.7.7
    cpe:2.3:a:fail2ban:fail2ban:0.7.7
  • Fail2Ban 0.7.6
    cpe:2.3:a:fail2ban:fail2ban:0.7.6
  • Fail2Ban 0.7.5
    cpe:2.3:a:fail2ban:fail2ban:0.7.5
  • Fail2Ban 0.7.4
    cpe:2.3:a:fail2ban:fail2ban:0.7.4
  • Fail2Ban 0.7.3
    cpe:2.3:a:fail2ban:fail2ban:0.7.3
  • Fail2Ban 0.7.2
    cpe:2.3:a:fail2ban:fail2ban:0.7.2
  • Fail2Ban 0.7.1
    cpe:2.3:a:fail2ban:fail2ban:0.7.1
  • Fail2Ban 0.7.0
    cpe:2.3:a:fail2ban:fail2ban:0.7.0
  • Fail2Ban 0.6.1
    cpe:2.3:a:fail2ban:fail2ban:0.6.1
  • Fail2Ban 0.6.0
    cpe:2.3:a:fail2ban:fail2ban:0.6.0
  • Fail2Ban 0.5.5
    cpe:2.3:a:fail2ban:fail2ban:0.5.5
  • Fail2Ban 0.5.4
    cpe:2.3:a:fail2ban:fail2ban:0.5.4
  • Fail2Ban 0.5.3
    cpe:2.3:a:fail2ban:fail2ban:0.5.3
  • Fail2Ban 0.5.2
    cpe:2.3:a:fail2ban:fail2ban:0.5.2
  • Fail2Ban 0.5.1
    cpe:2.3:a:fail2ban:fail2ban:0.5.1
  • Fail2Ban 0.5.0
    cpe:2.3:a:fail2ban:fail2ban:0.5.0
  • Fail2Ban 0.4.1
    cpe:2.3:a:fail2ban:fail2ban:0.4.1
  • Fail2Ban 0.4.0
    cpe:2.3:a:fail2ban:fail2ban:0.4.0
  • Fail2Ban 0.3.1
    cpe:2.3:a:fail2ban:fail2ban:0.3.1
  • Fail2Ban 0.3.0
    cpe:2.3:a:fail2ban:fail2ban:0.3.0
  • Fail2Ban 0.1.2
    cpe:2.3:a:fail2ban:fail2ban:0.1.2
  • Fail2Ban 0.1.1
    cpe:2.3:a:fail2ban:fail2ban:0.1.1
  • Fail2Ban 0.1.0
    cpe:2.3:a:fail2ban:fail2ban:0.1.0
CVSS
Base: 7.5 (as of 31-12-2012 - 09:51)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-20619.NASL
    description Update to 0.8.8 (CVE-2012-5642 Bug #887914) - Fixes : - Alan Jenkins - [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid banning due to misconfigured DNS. Close gh-64 - Yaroslav Halchenko - [83109bc] IMPORTANT: escape the content of (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team - [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3 - [37a2e59] store IP as a base, non-unicode str to avoid spurious messages in the console. Close gh-91 - New features : - David Engeset - [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86 - Yaroslav Halchenko - Enhancements : - [2d66f31] replaced uninformative 'Invalid command' message with warning log exception why command actually failed - [958a1b0] improved failregex to 'support' auth.backend = 'htdigest' - [9e7a3b7] until we make it proper module -- adjusted sys.path only if system-wide run - [f52ba99] downgraded 'already banned' from WARN to INFO level. Closes gh-79 - [f105379] added hints into the log on some failure return codes (e.g. 0x7f00 for this gh-87) - Various others: travis-ci integration, script to run tests against all available Python versions, etc Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-09
    plugin id 63343
    published 2012-12-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63343
    title Fedora 17 : fail2ban-0.8.8-1.fc17 (2012-20619)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-267.NASL
    description This update of fail2ban fixes a startup related startup-problem and a security problem fixed upstream (CVE-2012-5642).
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74950
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74950
    title openSUSE Security Update : fail2ban (openSUSE-SU-2013:0566-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-078.NASL
    description Updated fail2ban package fixes security vulnerability : fail2ban before 0.8.8 didn't escape the content of \ (if used in custom action files), which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain arbitrary symbols (CVE-2012-5642).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 66092
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66092
    title Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:078)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-20589.NASL
    description Update to 0.8.8 (CVE-2012-5642 Bug #887914) - Fixes : - Alan Jenkins - [8c38907] Removed 'POSSIBLE BREAK-IN ATTEMPT' from sshd filter to avoid banning due to misconfigured DNS. Close gh-64 - Yaroslav Halchenko - [83109bc] IMPORTANT: escape the content of (if used in custom action files) since its value could contain arbitrary symbols. Thanks for discovery go to the NBS System security team - [b159eab] do not enable pyinotify backend if pyinotify < 0.8.3 - [37a2e59] store IP as a base, non-unicode str to avoid spurious messages in the console. Close gh-91 - New features : - David Engeset - [2d672d1,6288ec2] 'unbanip' command for the client + avoidance of touching the log file to take 'banip' or 'unbanip' in effect. Close gh-81, gh-86 - Yaroslav Halchenko - Enhancements : - [2d66f31] replaced uninformative 'Invalid command' message with warning log exception why command actually failed - [958a1b0] improved failregex to 'support' auth.backend = 'htdigest' - [9e7a3b7] until we make it proper module -- adjusted sys.path only if system-wide run - [f52ba99] downgraded 'already banned' from WARN to INFO level. Closes gh-79 - [f105379] added hints into the log on some failure return codes (e.g. 0x7f00 for this gh-87) - Various others: travis-ci integration, script to run tests against all available Python versions, etc Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-05-09
    plugin id 63496
    published 2013-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63496
    title Fedora 18 : fail2ban-0.8.8-1.fc18 (2012-20589)
refmap via4
confirm
mandriva MDVSA-2013:078
mlist
  • [fail2ban-users] 20121206 0.8.8 release
  • [oss-security] 20121217 Re: CVE request: fail2ban 0.8.8 fixes an input variable quoting flaw on content
suse
  • openSUSE-SU-2013:0566
  • openSUSE-SU-2013:0567
Last major update 05-12-2013 - 00:20
Published 31-12-2012 - 06:50
Back to Top