Date: Sun, 28 Sep 2014 16:21:31 +0800 (WST) From: David Adam <zanchey@....gu.uwa.edu.au> To: oss-security@...ts.openwall.com cc: Bartlomiej Piotrowski <b@...otrowski.pl>, kov@...ian.org, luto@....edu, nemysis@...eBSD.org, ridiculous_fish <corydoras@...iculousfish.com> Subject: Security release of fish shell 2.1.1 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, It's been some months, but it seems like a good time to be announcing security releases of shells! fish (the friendly interactive shell) is a smart and user-friendly command line shell for OS X, Linux, and the rest of the family. fish 2.1.1 has been released as source and binary packages at http://fishshell.com/. This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability, as follows: CVE-2014-2905: fish universal variable socket vulnerable to permission bypass leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not check the credentials of processes communicating over the fishd universal variable server UNIX domain socket. This allows a local attacker to elevate their privileges to those of a target user running fish, including root. fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish. https://github.com/fish-shell/fish-shell/issues/1436 CVE-2014-2906 and CVE-2014-3856: fish temporary file creation vulnerable to race condition leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates temporary files in an insecure manner. Versions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from these temporary files, allowing privilege escalation to those of any user running fish, including root. (CVE-2014-3856) Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive), fish will read data using the psub function from these temporary files, meaning that the input of commands used with the psub function is under the control of the attacker. (CVE-2014-2906) fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish. https://github.com/fish-shell/fish-shell/issues/1437 CVE-2014-2914: fish web interface does not restrict access leading to remote code execution fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict connections to the Web-based configuration service (fish_config). This allows remote attackers to execute arbitrary code in the context of the user running fish_config. The service is generally only running for short periods of time. fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish, although the use of the fish_config tool is optional as other interfaces to fish configuration are available. https://github.com/fish-shell/fish-shell/issues/1438 CVE-2014-3219: fish temporary file access leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), uses temporary files in an insecure manner. fish will read and write completions from these temporary files without checking for ownership or symbolic links, allowing data corruption. fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish. https://github.com/fish-shell/fish-shell/issues/1440 David Adam fish committer zanchey@....gu.uwa.edu.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJUJpCYAAoJEMC5abKXToiOaH4P+wc6jU3vgo8y4CEjsYFwqFFl rK1c3ivAoy1DnJ4hB2jpANL+TrpfsRAmzcN1SdEj10SZVXz0MhyD+iX2ny3ZelS3 dL70Z+0aA6ry91esudMjPG5RrrOH0atJc1guLpw3Qhxnf+FBMFGOODq5dcT0uccT yVB6K1GJRkCUeS9+bJExSoSJ/tBRZbockmUUEs2DifQAAyQVY91kt6UNdEtuK+rt CB9G5DNwLEyL0He/TN66VVU1l6amGVCrxR5bW+y4aigYI1Jx51PC700rR2I61V+g ESSTsvNgh4URdL/XmEkiuPrAUJhdV4J+QXNEwj0qlHRpXA0Em8Y4yfQUXgfgIiZ8 zbBvAZLxZm3UcPFbcrteI5N2mMbAPGJJTFRPTQO9Pcc5SJzCL3WIR/0zAxruQ1x9 IlpgCD+lQA4EKVvFo0E9oWYfRe5NXHNiFjb0khjxBeWrKGMdhrFgagfZfCAdSYas Cb+1CcTKcT2V5RGCrS8dAAgCxznL93DMvveQUZt0oE3OYdjJsWYjITYx+V+xyiHv RUFmvOckPUMIVzMVoKppyrss7USqaie5REyG0nxSwujgzPL/lAWJlBTVI61JVWSy Yn2A5yVaXeqLAodg/bGivURGgyeFPbDE51xXqaGGlm8gr8+WbmiDqMKA/jIMvce3 sxlSlL9fpNwODfinFi2M =ICJE -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.