TUCoPS :: Unix :: General :: fsh-1.htm

Vulnerability
 fsh
Affected
 fsh
Description
 Following is based on a Debian Security Advisory DSA-002-1.
 Colin Phipps found an interesting symlink attack problem in fsh (a
 tool to quickly run remote commands over rsh/ssh/lsh). When fshd
 starts it creates a directory in /tmp to hold its sockets. It
 tries to do that securely by checking of it can chown that
 directory if it already exists to check if it is owner by the
 user invoking it. However an attacker can circumvent this check
 by inserting a symlink to a file that is owner by the user who
 runs fhsd and replacing that with a directory just before fshd
 creates the socket.
Solution
 For Debian:
 http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1-3potato.diff.gz
 http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1-3potato.dsc
 http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1.orig.tar.gz
 http://security.debian.org/dists/stable/updates/main/binary-alpha/fsh_1.0.post.1-3potato_alpha.deb
 http://security.debian.org/dists/stable/updates/main/binary-arm/fsh_1.0.post.1-3potato_arm.deb
 http://security.debian.org/dists/stable/updates/main/binary-i386/fsh_1.0.post.1-3potato_i386.deb
 http://security.debian.org/dists/stable/updates/main/binary-m68k/fsh_1.0.post.1-3potato_m68k.deb
 http://security.debian.org/dists/stable/updates/main/binary-powerpc/fsh_1.0.post.1-3potato_powerpc.deb
 http://security.debian.org/dists/stable/updates/main/binary-sparc/fsh_1.0.post.1-3potato_sparc.deb