[v3.0] fish: multiple issues (CVE-2014-2905, CVE-2014-2906, CVE-2014-3856, CVE-2014-2914, CVE-2014-3219)
A number of local privilege escalation vulnerabilities and one remote code execution vulnerability have been fixed in fish 2.1.1:
CVE-2014-2905: fish universal variable socket vulnerable to permission
bypass leading to privilege escalation
fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does
not
check the credentials of processes communicating over the fishd
universal
variable server UNIX domain socket. This allows a local attacker to
elevate their privileges to those of a target user running fish,
including
root.
fish version 2.1.1 is not vulnerable.
No workaround is currently available for earlier versions of fish.
https://github.com/fish-shell/fish-shell/issues/1436
CVE-2014-2906 and CVE-2014-3856: fish temporary file creation vulnerable
to race condition leading to privilege escalation
fish, from at least version 1.16.0 to version 2.1.0 (inclusive),
creates
temporary files in an insecure manner.
Versions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from
these
temporary files, allowing privilege escalation to those of any user
running fish, including root. (CVE-2014-3856)
Additionally, from at least version 1.16.0 to version 2.1.0
(inclusive),
fish will read data using the psub function from these temporary
files,
meaning that the input of commands used with the psub function is
under
the control of the attacker. (CVE-2014-2906)
fish version 2.1.1 is not vulnerable.
No workaround is currently available for earlier versions of fish.
https://github.com/fish-shell/fish-shell/issues/1437
CVE-2014-2914: fish web interface does not restrict access leading to
remote code execution
fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to
restrict
connections to the Web-based configuration service (fish_config).
This
allows remote attackers to execute arbitrary code in the context of
the
user running fish_config.
The service is generally only running for short periods of time.
fish version 2.1.1 is not vulnerable.
No workaround is currently available for earlier versions of fish,
although the use of the fish_config tool is optional as other
interfaces
to fish configuration are available.
https://github.com/fish-shell/fish-shell/issues/1438
CVE-2014-3219: fish temporary file access leading to privilege
escalation
fish, from at least version 1.16.0 to version 2.1.0 (inclusive), uses
temporary files in an insecure manner.
fish will read and write completions from these temporary files
without
checking for ownership or symbolic links, allowing data corruption.
fish version 2.1.1 is not vulnerable.
No workaround is currently available for earlier versions of fish.
https://github.com/fish-shell/fish-shell/issues/1440
Reported by David Adam
fish committer
zanchey () ucc gu uwa edu au
References:
http://seclists.org/oss-sec/2014/q3/799
(from redmine: issue id 3486, created on 2014-10-28, closed on 2017-05-17)
- Relations:
- parent #3484
- Changesets:
- Revision 67896fec by Natanael Copa on 2014-12-05T16:04:17Z:
main/fish: security upgrade to 2.1.1
fixes #3486
CVE-2014-2905
CVE-2014-2906
CVE-2014-3856
CVE-2014-2914
CVE-2014-3219