Adjusted changelog entry

Many kudos go to Michael Saavedra for the solution and the patch.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@784 a942ae1a-1317-0410-a47c-b1dcaea8d605

config/action.d/dshield.conf

@@ -206,5 +206,5 @@ dest = reports@dshield.org
 # Notes.:  Base name of temporary files used for buffering
 # Values:  [ STRING ]  Default: /tmp/fail2ban-dshield
 #
-tmpfile = /tmp/fail2ban-dshield
+tmpfile = /var/run/fail2ban/tmp-dshield
 

config/action.d/mail-buffered.conf

@@ -81,7 +81,7 @@ lines = 5
 
 # Default temporary file
 #
-tmpfile = /tmp/fail2ban-mail.txt
+tmpfile = /var/run/fail2ban/tmp-mail.txt
 
 # Destination/Addressee of the mail
 #

config/action.d/mynetwatchman.conf

@@ -141,4 +141,4 @@ mnwurl = http://mynetwatchman.com/insertwebreport.asp
 # Notes.:  Base name of temporary files
 # Values:  [ STRING ]  Default: /tmp/fail2ban-mynetwatchman
 #
-tmpfile = /tmp/fail2ban-mynetwatchman
+tmpfile = /var/run/fail2ban/tmp-mynetwatchman

config/action.d/sendmail-buffered.conf

@@ -101,5 +101,5 @@ lines = 5
 
 # Default temporary file
 #
-tmpfile = /tmp/fail2ban-mail.txt
+tmpfile = /var/run/fail2ban/tmp-mail.txt
 

debian/changelog

@@ -1,3 +1,15 @@
+fail2ban (0.8.4-3+squeeze1) stable; urgency=low
+
+  [ Jonathan Wiltshire ]
+  * [e2232fc] Backport patch to fix CVE-2009-5023: Insecure creation of
+    tempfile (Closes: #544232, #635746)
+
+  [ Yaroslav Halchenko ]
+  * [6fc6c7b] Backport patch: Lock server's executeCmd to prevent racing
+    among iptables calls (Closes: #650678)
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 16 Feb 2012 10:29:08 -0500
+
 fail2ban (0.8.4-3) unstable; urgency=low
 
   * Commenting out named-refused-udp jail and providing even fatter

server/action.py

@@ -25,11 +25,15 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"
 
 import logging, os
+import threading
 #from subprocess import call
 
 # Gets the instance of the logger.
 logSys = logging.getLogger("fail2ban.actions.action")
 
+# Create a lock for running system commands
+_cmd_lock = threading.Lock()
+
 ##
 # Execute commands.
 #
@@ -301,17 +305,21 @@ class Action:
 	#@staticmethod
 	def executeCmd(realCmd):
 		logSys.debug(realCmd)
-		try:
-			# The following line gives deadlock with multiple jails
-			#retcode = call(realCmd, shell=True)
-			retcode = os.system(realCmd)
-			if retcode == 0:
-				logSys.debug("%s returned successfully" % realCmd)
-				return True
-			else:
-				logSys.error("%s returned %x" % (realCmd, retcode))
-		except OSError, e:
-			logSys.error("%s failed with %s" % (realCmd, e))
+		_cmd_lock.acquire()
+		try: # Try wrapped within another try needed for python version < 2.5
+			try:
+				# The following line gives deadlock with multiple jails
+				#retcode = call(realCmd, shell=True)
+				retcode = os.system(realCmd)
+				if retcode == 0:
+					logSys.debug("%s returned successfully" % realCmd)
+					return True
+				else:
+					logSys.error("%s returned %x" % (realCmd, retcode))
+			except OSError, e:
+				logSys.error("%s failed with %s" % (realCmd, e))
+		finally:
+			_cmd_lock.release()
 		return False
 	executeCmd = staticmethod(executeCmd)