Attachment 840691 Details for Bug 1045982 – Patch for this vulnerability.

[patch] Patch for this vulnerability.

13_CVE-2013-6890.patch (text/plain), 3.48 KB, created by Ratul Gupta on 2013-12-23 06:42:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ratul Gupta

Created: 2013-12-23 06:42:16 UTC

Size: 3.48 KB

patch

obsolete

>Subject: address remote denial of service CVE-2013-6890
>From: Helmut Grohne <helmut () subdivi de>
>
>ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21
>
>results in a log lines
>
>sshd[123]: Invalid user Invalid user root from 123.123.123.123 from 21.21.21.21
>sshd[123]: input_userauth_request: invalid user Invalid user root from 123.123.123.123 [preauth]
>sshd[123]: Connection closed by 21.21.21.21 [preauth]
>
>and causes denyhosts to block both ips 21.21.21.21 and 123.123.123.123.
>
>This patch tightens the regular expressions used to avoid these and similar
>injections.
>
>Index: denyhosts-2.6/DenyHosts/regex.py
>===================================================================
>--- denyhosts-2.6.orig/DenyHosts/regex.py	2013-12-22 11:54:42.000000000 +0100
>+++ denyhosts-2.6/DenyHosts/regex.py	2013-12-22 11:55:05.000000000 +0100
>@@ -6,22 +6,22 @@
> 
> #DATE_FORMAT_REGEX = re.compile(r"""(?P<month>[A-z]{3,3})\s*(?P<day>\d+)""")
> 
>-SSHD_FORMAT_REGEX = re.compile(r""".* (sshd.*:|\[sshd\]) (?P<message>.*)""")
>+SSHD_FORMAT_REGEX = re.compile(r""".*? (sshd.*?:|\[sshd\]) (?P<message>.*)""")
> #SSHD_FORMAT_REGEX = re.compile(r""".* sshd.*: (?P<message>.*)""")
> 
>-FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P<method>.*) for (?P<invalid>invalid user |illegal user )?(?P<user>.*?) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
>+FAILED_ENTRY_REGEX = re.compile(r"""Failed (?P<method>\S*) for (?P<invalid>invalid user |illegal user )?(?P<user>.*) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
> 
>-FAILED_ENTRY_REGEX2 = re.compile(r"""(?P<invalid>(Illegal|Invalid)) user (?P<user>.*?) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
>+FAILED_ENTRY_REGEX2 = re.compile(r"""(?P<invalid>(Illegal|Invalid)) user (?P<user>.*) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
> 
>-FAILED_ENTRY_REGEX3 = re.compile(r"""Authentication failure for (?P<user>.*) .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
>+FAILED_ENTRY_REGEX3 = None
> 
>-FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P<user>.*) .*from (?P<host>.*)""")
>+FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P<user>.*) from (::ffff:)?(?P<host>\S+)$""")
> 
>-FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) .*from (?P<host>.*) not allowed because none of user's groups are listed in AllowGroups$""")
>+FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) from (::ffff:)?(?P<host>\S+) not allowed because none of user's groups are listed in AllowGroups$""")
> 
>-FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
>+FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string .*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
> 
>-FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P<user>.*) from (?P<host>.*) not allowed because not listed in AllowUsers""")
>+FAILED_ENTRY_REGEX7 = re.compile(r"""User (?P<user>.*) from (::ffff:)?(?P<host>\S+) not allowed because not listed in AllowUsers$""")
> 
> 
> # these are reserved for future versions
>@@ -42,7 +42,7 @@
>     FAILED_ENTRY_REGEX_MAP[i] = rx
> 
> 
>-SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P<method>.*) for (?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
>+SUCCESSFUL_ENTRY_REGEX = re.compile(r"""Accepted (?P<method>\S+) for (?P<user>.*?) from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$""")
> 
> TIME_SPEC_REGEX = re.compile(r"""(?P<units>\d*)\s*(?P<period>[smhdwy])?""")
>

Actions: View | Diff

Attachments on bug 1045982: 840691