The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fail2ban | Fail2ban | * | 0.8.4 (including) |
| Fail2ban | Fail2ban | 0.1.0 (including) | 0.1.0 (including) |
| Fail2ban | Fail2ban | 0.1.1 (including) | 0.1.1 (including) |
| Fail2ban | Fail2ban | 0.1.2 (including) | 0.1.2 (including) |
| Fail2ban | Fail2ban | 0.3.0 (including) | 0.3.0 (including) |
| Fail2ban | Fail2ban | 0.3.1 (including) | 0.3.1 (including) |
| Fail2ban | Fail2ban | 0.4.0 (including) | 0.4.0 (including) |
| Fail2ban | Fail2ban | 0.4.1 (including) | 0.4.1 (including) |
| Fail2ban | Fail2ban | 0.5.0 (including) | 0.5.0 (including) |
| Fail2ban | Fail2ban | 0.5.1 (including) | 0.5.1 (including) |
| Fail2ban | Fail2ban | 0.5.2 (including) | 0.5.2 (including) |
| Fail2ban | Fail2ban | 0.5.3 (including) | 0.5.3 (including) |
| Fail2ban | Fail2ban | 0.5.4 (including) | 0.5.4 (including) |
| Fail2ban | Fail2ban | 0.5.5 (including) | 0.5.5 (including) |
| Fail2ban | Fail2ban | 0.6.0 (including) | 0.6.0 (including) |
| Fail2ban | Fail2ban | 0.6.1 (including) | 0.6.1 (including) |
| Fail2ban | Fail2ban | 0.7.0 (including) | 0.7.0 (including) |
| Fail2ban | Fail2ban | 0.7.1 (including) | 0.7.1 (including) |
| Fail2ban | Fail2ban | 0.7.2 (including) | 0.7.2 (including) |
| Fail2ban | Fail2ban | 0.7.3 (including) | 0.7.3 (including) |
| Fail2ban | Fail2ban | 0.7.4 (including) | 0.7.4 (including) |
| Fail2ban | Fail2ban | 0.7.5 (including) | 0.7.5 (including) |
| Fail2ban | Fail2ban | 0.7.6 (including) | 0.7.6 (including) |
| Fail2ban | Fail2ban | 0.7.7 (including) | 0.7.7 (including) |
| Fail2ban | Fail2ban | 0.7.8 (including) | 0.7.8 (including) |
| Fail2ban | Fail2ban | 0.7.9 (including) | 0.7.9 (including) |
| Fail2ban | Fail2ban | 0.8.0 (including) | 0.8.0 (including) |
| Fail2ban | Fail2ban | 0.8.1 (including) | 0.8.1 (including) |
| Fail2ban | Fail2ban | 0.8.2 (including) | 0.8.2 (including) |
| Fail2ban | Fail2ban | 0.8.3 (including) | 0.8.3 (including) |
| Fail2ban | Ubuntu | hardy | * |
| Fail2ban | Ubuntu | lucid | * |
| Fail2ban | Ubuntu | maverick | * |
| Fail2ban | Ubuntu | natty | * |
| Fail2ban | Ubuntu | upstream | * |