Fail2ban Cyrus-imap Filter Remote Denial of Service Vulnerability

Bugtraq ID:	65187
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-7177
Remote:	Yes
Local:	No
Published:	Jan 28 2014 12:00AM
Updated:	Jul 21 2014 12:59AM
Credit:	Steven Hiscocks
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Fail2ban Cyrus-imap Filter Remote Denial of Service Vulnerability

Fail2ban is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to add arbitrary IP addresses to the block list used by the application. This allows attackers to deny further network access to arbitrary IP addresses, denying service to legitimate users.

Versions prior to Fail2ban 0.8.11 are vulnerable.

Fail2ban Cyrus-imap Filter Remote Denial of Service Vulnerability

To exploit this issue attackers can use readily available network utilities.

Fail2ban Cyrus-imap Filter Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Fail2ban Cyrus-imap Filter Remote Denial of Service Vulnerability

References:

• Fail2ban Home Page (Cyril Jaquier)