CVE-2009-0362: Medium severity fail2ban fail2ban vulnerability
filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address, a different vulnerability than CVE-2007-4321.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Edit filter.d/wuftpd.conf in the Fail2ban installation (for example /etc/fail2ban/filter.d/wuftpd.conf) and replace the existing rhost-matching regular expression with a corrected pattern that validates whole IP addresses or hostnames so that substrings are not misinterpreted as IP addresses. After making the change, restart Fail2ban and test wuftpd-related matches to confirm the fix.
Fail2ban filter.d/wuftpd.conf rhost matching regular expression = use a regular expression that validates entire IP addresses or hostnames and does not treat substrings as IP addresses
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0362?
CVE-2009-0362 has a moderate severity level due to the potential for denial of service attacks.
How do I fix CVE-2009-0362?
To fix CVE-2009-0362, you should upgrade to a newer version of Fail2ban that has addressed this vulnerability.
Which versions of Fail2ban are affected by CVE-2009-0362?
CVE-2009-0362 specifically affects Fail2ban version 0.8.3.
What type of attack does CVE-2009-0362 allow?
CVE-2009-0362 allows remote attackers to execute denial of service attacks via crafted reverse-resolved DNS names.
Is CVE-2009-0362 a local or remote vulnerability?
CVE-2009-0362 is a remote vulnerability that can be exploited by attackers over a network.