CVE-2013-6890: Medium severity Debian Debian Linux vulnerability
denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.
Other sources
It was found that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon.
Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user to forge crafted login names in order to make denyhosts ban arbitrary IP addresses.
A solution is proposed by the reporter, which is to tighten up the regular expressions for matching log file entries. Specifically including the $ pattern to match the end of log lines.
References: http://seclists.org/oss-sec/2013/q4/535 http://www.debian.org/security/2013/dsa-2826
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6890?
CVE-2013-6890 has been classified as a denial of service vulnerability, which can lead to incorrect blocking of IP addresses.
How do I fix CVE-2013-6890?
To fix CVE-2013-6890, update to a version of DenyHosts that has resolved this vulnerability, as listed by your operating system's package manager.
What software is affected by CVE-2013-6890?
CVE-2013-6890 affects DenyHosts version 2.6 and various Debian and Fedora Linux distributions.
Can CVE-2013-6890 be exploited remotely?
Yes, CVE-2013-6890 can be exploited by remote attackers through crafted login names.
Is there a workaround for CVE-2013-6890?
A temporary workaround for CVE-2013-6890 may involve manually managing IP blocking settings until an update is available.