Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 509044 (CVE-2014-2905) - <app-shells/fish-2.1.1: Multiple vulnerabilities (CVE-2014-{2905,2906,2914,3219})
Summary: <app-shells/fish-2.1.1: Multiple vulnerabilities (CVE-2014-{2905,2906,2914,32...
Status: RESOLVED FIXED
Alias: CVE-2014-2905
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B1 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-04-29 08:38 UTC by Agostino Sarubbo
Modified: 2014-12-28 08:43 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-04-29 08:38:43 UTC
From ${URL} :

A number of vulnerabilities were reported in fish versions prior to 2.1.1 [1]:

CVE-2014-2905: fish universal variable socket vulnerable to permission bypass
leading to privilege escalation

  fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not
  check the credentials of processes communicating over the fishd universal
  variable server UNIX domain socket. This allows a local attacker to elevate
  their privileges to those of a target user running fish, including root.

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish.

  https://github.com/fish-shell/fish-shell/issues/1436

CVE-2014-2906: fish temporary file creation vulnerable to race condition
leading to privilege escalation

  fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates
  temporary files in an insecure manner.

  Versions 1.23.0 to 2.1.0 (inclusive) execute code from these temporary files,
  allowing privilege escalation to those of any user running fish, including
  root.

  Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive),
  fish will read data using the psub function from these temporary files,
  meaning that the input of commands used with the psub function is under the
  control of the attacker.

  fish version 2.1.1 is not vulnerable.

  No workaround is currently available for earlier versions of fish.

  https://github.com/fish-shell/fish-shell/issues/1437

CVE-2014-2914: fish web interface does not restrict access leading to remote
code execution

  fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict
  connections to the Web-based configuration service (fish_config). This
  allows remote attackers to execute arbitrary code in the context of the user
  running fish_config.

  The service is generally only running for short periods of time.

  fish version 2.1.1 restricts incoming connections to localhost only. At this
  stage, users should avoid running fish_config on systems where there are
  untrusted local users, as they are still able to connect to the fish_config
  service and elevate their privileges to those of the user running
  fish_config.

  No workaround is currently available for earlier versions of fish, although
  the use of the fish_config tool is optional as other interfaces to fish
  configuration are available.

  https://github.com/fish-shell/fish-shell/issues/1438

The patches going into 2.1.1 can be retrieved from the Integration_2.1.1 branch
on Github if you would like to patch your own source or packages without
updating to 2.1.1:
https://github.com/fish-shell/fish-shell/tree/Integration_2.1.1
  10642a34f17ae45bd93be3ae6021ee920d3da0c2
  8412c867a501e3a68e55fef6215e86d3ac9f617b
  c0989dce2d882c94eb3183e7b94402ba53534abb

Although at this stage we won't be issuing a 2.0.1 release, the patches have
been backported to the 2.0.0 branch for distributions that would prefer not to
upgrade to the 2.1 series:
https://github.com/fish-shell/fish-shell/tree/Integration_2.0.1
  216d32055d99fbae563ad048436830187a8bfceb
  aea9ad4965d24ef9c4e346f906194820bac70cc9
  55986120aa2cc8ab0809db8ca1f8116491c1fb14


[1] http://www.openwall.com/lists/oss-security/2014/04/28/4


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-04-29 09:36:46 UTC
No release tarball available yet...
Comment 2 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-05-15 09:56:52 UTC
Still no release yet:

http://sourceforge.net/p/fish/mailman/message/32280902/
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-05-15 10:05:33 UTC
CVE-2014-2905 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2905):
  fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the
  credentials, which allows local users to gain privileges via the universal
  variable socket, related to /tmp/fishd.socket.user permissions.
Comment 4 Yury German Gentoo Infrastructure gentoo-dev 2014-06-05 11:39:16 UTC
Still not available adding rest of CVE's
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2014-06-18 13:03:16 UTC
Another symlink account has been found and CVE assigned for it.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746259#10
Comment 6 Jelte Fennema 2014-10-28 18:19:15 UTC
2.1.1 has been released about a month ago:
https://github.com/fish-shell/fish-shell/releases
Comment 7 Jelte Fennema 2014-11-10 21:36:37 UTC
I just got a working ebuild in my overlay by renaming the 2.1.0-r3 one to 2.1.1

I think it would be good if this could be updated in the main repositories, since it fixes these security bugs.
Comment 8 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-11-17 15:55:32 UTC
+*fish-2.1.1 (17 Nov 2014)
+
+  17 Nov 2014; Lars Wendler <polynomial-c@gentoo.org> -fish-2.0.0.ebuild,
+  +fish-2.1.1.ebuild:
+  Security bump (bug #509044). Removed old.
+

Arches please test and mark stable =app-shells/fish-2.1.1 with target KEYWORDS:

amd64 ppc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~x86-solaris
Comment 9 Agostino Sarubbo gentoo-dev 2014-11-18 10:04:33 UTC
amd64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-11-18 10:05:05 UTC
x86 stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-12-03 09:57:56 UTC
ppc stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 12 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-12-06 09:33:34 UTC
+  06 Dec 2014; Lars Wendler <polynomial-c@gentoo.org> -fish-2.1.0-r2.ebuild,
+  -fish-2.1.0-r3.ebuild:
+  Removed vulnerable versions.
+
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2014-12-28 08:43:38 UTC
This issue was resolved and addressed in
 GLSA 201412-49 at http://security.gentoo.org/glsa/glsa-201412-49.xml
by GLSA coordinator Mikle Kolyada (Zlogene).