Debian DSA-6580-1: Erlang/OTP Critical Auth Bypass, TLS Impersonation & Request Smuggling — Emergency Patch Guide

---
title: Anomalous TLS Certificate Presented to Erlang/OTP Client
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects TLS handshake anomalies that may indicate server impersonation attempts against Erlang/OTP clients. Monitors for certificate validation failures and unexpected certificate changes on Erlang nodes.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6580-1-erlang
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1557
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - '/usr/lib/erlang'
      - 'beam.smp'
    DestinationPort:
      - 5671
      - 5672
      - 4369
      - 25672
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate outbound TLS connections from Erlang nodes to external services
level: medium
---
title: HTTP Request Smuggling Indicators Against Erlang Inets
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects HTTP request smuggling attempts targeting Erlang/OTP inets HTTP server. Identifies malformed HTTP headers and conflicting Content-Length/Transfer-Encoding headers characteristic of smuggling attacks.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6580-1-erlang
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection:
    c-uri|contains:
      - '/rabbitmq'
      - '/api/'
    http_method: 'POST'
  headers:
    cs-headers|contains:
      - 'Transfer-Encoding'
      - 'Content-Length'
  condition: selection and headers
falsepositives:
  - Legitimate POST requests with chunked encoding
level: high
---
title: Unauthorized Access to Erlang EPMD or RabbitMQ Management
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects unauthorized access attempts to Erlang Port Mapper Daemon (EPMD) or RabbitMQ management interface. May indicate exploitation of authentication bypass vulnerabilities in Erlang/OTP.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6580-1-erlang
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort:
      - 4369
      - 15672
      - 25672
  filter:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate cluster communication
  - Monitoring system checks
level: high

// Hunt 1: TLS Certificate Anomalies for Erlang/OTP Services
// Detects potential TLS impersonation by identifying certificate validation failures
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName contains "beam" or ProcessName contains "erlang"
| where SyslogMessage contains "tls" or SyslogMessage contains "ssl" or SyslogMessage contains "certificate"
| where SyslogMessage contains "fail" or SyslogMessage contains "error" or SyslogMessage contains "invalid"
| summarize count() by Computer, SyslogMessage, TimeGenerated
| order by TimeGenerated desc

// Hunt 2: External Connections to Erlang/OTP Ports
// Identifies unexpected external connections to EPMD (4369), RabbitMQ (5672/15672), and distribution ports
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (4369, 5672, 15672, 25672)
| where ipv4_is_private(SourceIP) == false
| summarize count() by SourceIP, DestinationPort, DestinationHostName, TimeGenerated
| order by TimeGenerated desc

// Hunt 3: HTTP Request Smuggling Patterns in Web Logs
// Detects conflicting Content-Length and Transfer-Encoding headers
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod == "POST"
| where RequestHeaders has "Transfer-Encoding" and RequestHeaders has "Content-Length"
| where RequestURL contains "rabbitmq" or RequestURL contains "api"
| summarize count() by SourceIP, RequestURL, TimeGenerated
| order by TimeGenerated desc

// Hunt 4: Unexpected Process Spawns from Erlang/OTP
// Detects potential post-exploitation activity where beam.smp spawns unusual child processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName contains "beam.smp"
| where FileName !contains "epmd" and FileName !contains "erl_child_setup" and FileName !contains "inet_gethost"
| summarize count() by DeviceName, FileName, ProcessCommandLine, TimeGenerated
| order by TimeGenerated desc

-- Hunt for anomalous processes spawned by Erlang/OTP beam.smp
-- Post-exploitation activity often involves beam.smp spawning shells or downloaders
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'beam.smp'
   OR CommandLine =~ 'erlang'
   OR Exe =~ '/usr/lib/erlang'

-- Hunt for suspicious child processes of Erlang/OTP
SELECT Pid, Ppid, Name, CommandLine, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ 'beam.smp'
)
AND Name !~ 'epmd'
AND Name !~ 'erl_child_setup'
AND Name !~ 'inet_gethost'
AND Name !~ 'sh'
AND Name !~ 'bash'

-- Hunt for network connections on Erlang/OTP ports from unexpected sources
SELECT * FROM netstat()
WHERE LocalPort IN (4369, 5672, 15672, 25672)
   AND RemoteAddress !~ '^10\\.'
   AND RemoteAddress !~ '^172\\.(1[6-9]|2[0-9]|3[01])\\.'
   AND RemoteAddress !~ '^192\\.168\\.'
   AND RemoteAddress !~ '^127\\.'
   AND RemoteAddress !~ '^::1'

#!/bin/bash
# DSA-6580-1 Erlang/OTP Security Update Script
# Run with root privileges on Debian systems

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${YELLOW}[*] DSA-6580-1 Erlang/OTP Remediation Script${NC}"
echo "================================================"

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}[!] Please run as root${NC}"
    exit 1
fi

# Detect Debian version
if [ -f /etc/os-release ]; then
    . /etc/os-release
    echo -e "${GREEN}[+] OS: $PRETTY_NAME${NC}"
else
    echo -e "${RED}[!] Cannot detect OS version${NC}"
    exit 1
fi

# Check if Erlang/OTP is installed
if ! command -v erl &> /dev/null; then
    echo -e "${YELLOW}[!] Erlang/OTP not found on this system${NC}"
    exit 0
fi

# Get current Erlang version
ERLANG_VERSION=$(erl -eval '{ok, Version} = file:read_file(filename:join([code:root_dir(), "releases", erlang:system_info(otp_release), "OTP_VERSION"])), io:fwrite("~s", [Version]), halt().' -noshell 2>/dev/null || echo "unknown")
echo -e "${GREEN}[+] Current Erlang/OTP Version: $ERLANG_VERSION${NC}"

# Check installed Erlang packages
echo -e "${YELLOW}[*] Installed Erlang packages:${NC}"
dpkg -l | grep -i erlang | awk '{print $2, $3}' | head -20

# Update package lists
echo -e "${YELLOW}[*] Updating package lists...${NC}"
apt-get update -y

# Check for available Erlang updates
echo -e "${YELLOW}[*] Checking for Erlang security updates...${NC}"
apt-get upgrade -s 2>/dev/null | grep -i erlang || echo "No erlang updates in simulation"

# Apply security updates
echo -e "${YELLOW}[*] Applying security updates for Erlang/OTP...${NC}"
apt-get upgrade -y erlang-base erlang-asn1 erlang-public-key erlang-ssl erlang-inets erlang-ssh erlang-crypto erlang-syntax-tools erlang-tools erlang-runtime-tools erlang-mnesia erlang-os-mon erlang-snmp erlang-xmerl erlang-parsetools erlang-eunit erlang-erl-docgen erlang-edoc erlang-eldap erlang-ftp erlang-tftp erlang-diameter erlang-reltool erlang-observer erlang-et erlang-wx erlang-debugger erlang-megaco erlang-odbc erlang-dialyzer

# Alternative: full system upgrade if selective fails
if [ $? -ne 0 ]; then
    echo -e "${YELLOW}[*] Selective upgrade failed, attempting full upgrade...${NC}"
    apt-get upgrade -y
fi

# Verify update
echo -e "${YELLOW}[*] Verifying Erlang/OTP version after update...${NC}"
NEW_VERSION=$(erl -eval '{ok, Version} = file:read_file(filename:join([code:root_dir(), "releases", erlang:system_info(otp_release), "OTP_VERSION"])), io:fwrite("~s", [Version]), halt().' -noshell 2>/dev/null || echo "unknown")
echo -e "${GREEN}[+] Updated Erlang/OTP Version: $NEW_VERSION${NC}"

# Check for running Erlang processes that may need restart
echo -e "${YELLOW}[*] Checking for running Erlang processes...${NC}"
pgrep -a beam || echo "No beam processes found"

# Restart services if they exist
echo -e "${YELLOW}[*] Restarting Erlang-dependent services...${NC}"
for service in rabbitmq-server couchdb epmd; do
    if systemctl is-active --quiet "$service"; then
        echo -e "${GREEN}[+] Restarting $service...${NC}"
        systemctl restart "$service"
    fi
done

echo "================================================"
echo -e "${GREEN}[+] DSA-6580-1 remediation complete${NC}"
echo -e "${YELLOW}[*] Please verify all Erlang/OTP applications are functioning correctly${NC}"
echo -e "${YELLOW}[*] Monitor logs for TLS certificate errors or authentication failures${NC}"