CVE-2014-5284 Vulnerability Fixed in OSSEC 2.8.1

OSSEC 2.8.1 has been released to address the security issue identified by Jeff Petersen of Roka Security LLC. Full details of the issue can be found on the OSSEC Github repository – https://github.com/ossec/ossec-hids/releases/tag/2.8.1.

This correction will create the temp file for the hosts deny file in /var/ossec and will use mktemp where available to create NON-predictable temp file name. In cases where mktemp is not available we have written a BAD version of mktemp, but should be a little better then just process id.

In terms of features this release is the same as OSSEC 2.8. The OSSEC 2.8 Windows agent has not been updated.