Debian DSA-002-1 Critical: Fsh Symlink Attack Mitigation Details

Package : fsh
Problem type : symlink attack
Debian-specific: no

Colin Phipps found an interesting symlink attack problem in fsh (a
tool to quickly run remote commands over rsh/ssh/lsh). When fshd
starts it creates a directory in /tmp to hold its sockets. It tries
to do that securely by checking of it can chown that directory if
it already exists to check if it is owner by the user invoking it.
However an attacker can circumvent this check by inserting a
symlink to a file that is owner by the user who runs fhsd and
replacing that with a directory just before fshd creates the
socket.

This has been fixed in version 1.0.post.1-3potato.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.


Debian GNU/Linux 2.2 alias potato

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.


Source archives:

MD5 checksum: 278a82a3899974ec60b4f92d3a2d53d7

MD5 checksum: d2e6eee08ba39ed82b756f39da2a1587

MD5 checksum: ...