Debian Security Advisory

DSA-002-1 fsh -- symlink attack

Date Reported:

30 Nov 2000

Affected Packages:

fsh

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2000-1135.

More information:

Colin Phipps found an interesting symlink attack problem in fsh (a tool to quickly run remote commands over rsh/ssh/lsh). When fshd starts it creates a directory in /tmp to hold its sockets. It tries to do that securely by checking if it can chown that directory if it already exists to check if it is owned by the user invoking it. However an attacker can circumvent this check by inserting a symlink to a file that is owned by the user who runs fshd and replacing that with a directory just before fshd creates the socket.

Fixed in:

Debian 2.2 (potato)

Source:: http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1-3potato.diff.gz; http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1-3potato.dsc; http://security.debian.org/dists/stable/updates/main/source/fsh_1.0.post.1.orig.tar.gz
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/fsh_1.0.post.1-3potato_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/fsh_1.0.post.1-3potato_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/fsh_1.0.post.1-3potato_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/fsh_1.0.post.1-3potato_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/fsh_1.0.post.1-3potato_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/fsh_1.0.post.1-3potato_sparc.deb