Bugzilla Bug 181213

Another log injection issue in denyhosts.

Adding netmon herd. This is a whole SSH DoS issue. The initial fix seems
incomplete, i sent you an email.

Waiting on reply from upstream.

From my perspective this is an upstream issue. If I'm getting to the stage
where I have to maintain a patchset from the main codebase then I'd rather just
yank it from the tree as I'm not interested in maintaining security patches for
what is after all meant to be a security tool.

thanks for your reply, let's hope that upstream will fix this, otherwise we
will have to mask this package.

I think we should yank it, even if he does fix it, local users can still attack
it with logger.

Benjamin, any news from upstream?

I agree that this is upstream issue. But while we are waiting for news from
UPSTREAM I've bumped ebuild with the fixes from redhat:
https://bugzilla.redhat.com/show_bug.cgi?id=237449
https://bugzilla.redhat.com/show_bug.cgi?id=244943
It should address this log injection.

Now I'm not sure what best shall we do, stabilize or mask. Taking short look at
forums I'd say that users use it and it's better to keep. But personally I do
not use this tool so I'd like somebody else to take this decision.

I think we should mask this one.

(In reply to comment #7)
> I think we should mask this one.

Why? Masking doesn't make anything easier for us than stabling this.

It should be the maintainer's decision to Last-Rite and not that of Security
once a security issue is fixed.

@rbu It was just my personal opinion.

Arches please test and mark stable. Target keywords are:

denyhosts-2.6-r1.ebuild:KEYWORDS="alpha amd64 hppa ~ppc sparc x86"

x86 stable

Stable for HPPA.

alpha/sparc stable

By the way, I just wanted to throw in my two cents as a user of this package.

I find it a helpful and useful program, and would be very sad if it was removed
from the tree.

It is a little sad that UPSTREAM seems to be losing interest in this program. 
He's getting slower and slower about fixing/improving things.  But I'd rather
have this program than not have it.  Additionally I appreciate the maintainers
of this ebuild for keeping it patched & working when it matters -- especially
when UPSTREAM is slow/appears dead.


> local users can still attack it with logger.

I trust my local users -- that's why they have accounts.  I don't trust people
trying to break into my machine from the internet -- that's why I use this
program.

<rant>
I know, I know.... layers of security ... an onion....  But that's hog-wash if
I don't have a defense from random people running scripts against my box from
all over the world at all hours of the day.  At least if a local user starts
doing something strange, I know where they live and can go smack them upside
the head.  Plane tickets to China are too expensive.
</rant>

This is CVE-2007-4323.

amd64 stable

B3 -> [glsa?]

Please vote.

it can block SSH connections from everywhere. I vote yes.

voting yes too, request filed.

GLSA 200710-14, sorry for the delay.