Remote Denial-of-Service Vulnerability in Fail2ban

vendor:

Fail2ban

by:

7.5

CVSS

HIGH

Remote Denial-of-Service

CWE

Product Name: Fail2ban

Affected Version From: Fail2ban 0.8.0

Affected Version To: Fail2ban 0.8.0

Patch Exists: YES

Related CWE:

CPE: cpe:2.3:a:fail2ban_project:fail2ban:0.8.0:*:*:*:*:*:*:*

Metasploit:

Other Scripts:

Platforms Tested:

Remote Denial-of-Service Vulnerability in Fail2ban

The vulnerability in Fail2ban allows remote attackers to add arbitrary IP addresses to the block list used by the application, denying service to legitimate users.

Mitigation:

Upgrade to Fail2ban version 0.8.1 or later.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/25117/info

Fail2ban is prone to a remote denial-of-service vulnerability because the application fails to properly ensure the validity of authentication-failure messages.

Successfully exploiting this issue allows remote attackers to add arbitrary IP addresses to the block list used by the application. This allows attackers to deny further network access to arbitrary IP addresses, denying service to legitimate users.

Fail2ban 0.8.0 and prior versions are vulnerable to this issue. 

This issue may be demonstrated by connecting to an SSH server with 'nc', and sending the following string:

ROOT LOGIN REFUSED hi FROM 1.2.3.4

where '1.2.3.4' is an IP address to be blocked.