denyhosts 2.6 uses an incorrect regular expression when analyzing authentication logs, which allows remote attackers to cause a denial of service (incorrect block of IP addresses) via crafted login names.

Fix security bug

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-23 (DenyHosts: Denial of Service)

    DenyHosts does not properly define the regular expressions used when       parsing SSH authentication logs.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a crafted login name.
  Workaround :

    There is no known workaround at this time.

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute-force attacks in authentication logs could be exploited by a malicious user to forge crafted login names in order to make denyhosts ban arbitrary IP addresses.

ID	Name	Product	Family	Severity
80372	Fedora 19 : denyhosts-2.6-28.fc19.1 (2014-17081)	Nessus	Fedora Local Security Checks	medium
80371	Fedora 20 : denyhosts-2.6-29.fc20.1 (2014-17067)	Nessus	Fedora Local Security Checks	medium
76225	GLSA-201406-23 : DenyHosts: Denial of Service	Nessus	Gentoo Local Security Checks	medium
71586	Debian DSA-2826-1 : denyhosts - remote denial of ssh service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6890

high

Tenable Plugins

medium

medium

medium

medium