The OVAL Repository 5.4 2015-09-03T06:36:40.299-04:00 openSUSE 11.4 openSUSE 12.2 openSUSE 12.3 The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block arbitrary IP addresses via certain messages in a request. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.2 openSUSE 12.2 is installed. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 11.4 openSUSE 11.4 is installed. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.3 keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora. Maria Kedovskaya DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.3 The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.3 X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.3 The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED openSUSE 12.3 openSUSE 12.3 is installed. Maria Kedovskaya DRAFT INTERIM ACCEPTED Jerome Athias INTERIM ACCEPTED ACCEPTED