Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <alpine.DEB.2.02.1409271820580.15050@motsugo.ucc.gu.uwa.edu.au>
Date: Sun, 28 Sep 2014 16:21:31 +0800 (WST)
From: David Adam <zanchey@....gu.uwa.edu.au>
To: oss-security@...ts.openwall.com
cc: Bartlomiej Piotrowski <b@...otrowski.pl>, kov@...ian.org, luto@....edu, 
    nemysis@...eBSD.org, ridiculous_fish <corydoras@...iculousfish.com>
Subject: Security release of fish shell 2.1.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

It's been some months, but it seems like a good time to be announcing
security releases of shells!

fish (the friendly interactive shell) is a smart and user-friendly command
line shell for OS X, Linux, and the rest of the family.

fish 2.1.1 has been released as source and binary packages at
http://fishshell.com/.

This release fixes a number of local privilege escalation vulnerability
and one remote code execution vulnerability, as follows:

CVE-2014-2905: fish universal variable socket vulnerable to permission 
bypass leading to privilege escalation

  fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not
  check the credentials of processes communicating over the fishd universal
  variable server UNIX domain socket. This allows a local attacker to 
  elevate their privileges to those of a target user running fish, including 
  root.

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish.

  https://github.com/fish-shell/fish-shell/issues/1436

CVE-2014-2906 and CVE-2014-3856: fish temporary file creation vulnerable to 
race condition leading to privilege escalation

  fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates
  temporary files in an insecure manner.

  Versions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from these
  temporary files, allowing privilege escalation to those of any user 
  running fish, including root. (CVE-2014-3856)

  Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive),
  fish will read data using the psub function from these temporary files,
  meaning that the input of commands used with the psub function is under 
  the control of the attacker. (CVE-2014-2906)

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish.

  https://github.com/fish-shell/fish-shell/issues/1437

CVE-2014-2914: fish web interface does not restrict access leading to remote
code execution

  fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict
  connections to the Web-based configuration service (fish_config). This
  allows remote attackers to execute arbitrary code in the context of the 
  user running fish_config.

  The service is generally only running for short periods of time.

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish, 
  although the use of the fish_config tool is optional as other interfaces 
  to fish configuration are available.

  https://github.com/fish-shell/fish-shell/issues/1438

CVE-2014-3219: fish temporary file access leading to privilege escalation

  fish, from at least version 1.16.0 to version 2.1.0 (inclusive), uses
  temporary files in an insecure manner.

  fish will read and write completions from these temporary files without
  checking for ownership or symbolic links, allowing data corruption.

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish.

  https://github.com/fish-shell/fish-shell/issues/1440

David Adam
fish committer
zanchey@....gu.uwa.edu.au
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJUJpCYAAoJEMC5abKXToiOaH4P+wc6jU3vgo8y4CEjsYFwqFFl
rK1c3ivAoy1DnJ4hB2jpANL+TrpfsRAmzcN1SdEj10SZVXz0MhyD+iX2ny3ZelS3
dL70Z+0aA6ry91esudMjPG5RrrOH0atJc1guLpw3Qhxnf+FBMFGOODq5dcT0uccT
yVB6K1GJRkCUeS9+bJExSoSJ/tBRZbockmUUEs2DifQAAyQVY91kt6UNdEtuK+rt
CB9G5DNwLEyL0He/TN66VVU1l6amGVCrxR5bW+y4aigYI1Jx51PC700rR2I61V+g
ESSTsvNgh4URdL/XmEkiuPrAUJhdV4J+QXNEwj0qlHRpXA0Em8Y4yfQUXgfgIiZ8
zbBvAZLxZm3UcPFbcrteI5N2mMbAPGJJTFRPTQO9Pcc5SJzCL3WIR/0zAxruQ1x9
IlpgCD+lQA4EKVvFo0E9oWYfRe5NXHNiFjb0khjxBeWrKGMdhrFgagfZfCAdSYas
Cb+1CcTKcT2V5RGCrS8dAAgCxznL93DMvveQUZt0oE3OYdjJsWYjITYx+V+xyiHv
RUFmvOckPUMIVzMVoKppyrss7USqaie5REyG0nxSwujgzPL/lAWJlBTVI61JVWSy
Yn2A5yVaXeqLAodg/bGivURGgyeFPbDE51xXqaGGlm8gr8+WbmiDqMKA/jIMvce3
sxlSlL9fpNwODfinFi2M
=ICJE
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.