A number of vulnerabilities were reported in fish versions prior to 2.1.1 [1]: CVE-2014-2905: fish universal variable socket vulnerable to permission bypass leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not check the credentials of processes communicating over the fishd universal variable server UNIX domain socket. This allows a local attacker to elevate their privileges to those of a target user running fish, including root. fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish. https://github.com/fish-shell/fish-shell/issues/1436 CVE-2014-2906: fish temporary file creation vulnerable to race condition leading to privilege escalation fish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates temporary files in an insecure manner. Versions 1.23.0 to 2.1.0 (inclusive) execute code from these temporary files, allowing privilege escalation to those of any user running fish, including root. Additionally, from at least version 1.16.0 to version 2.1.0 (inclusive), fish will read data using the psub function from these temporary files, meaning that the input of commands used with the psub function is under the control of the attacker. fish version 2.1.1 is not vulnerable. No workaround is currently available for earlier versions of fish. https://github.com/fish-shell/fish-shell/issues/1437 CVE-2014-2914: fish web interface does not restrict access leading to remote code execution fish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict connections to the Web-based configuration service (fish_config). This allows remote attackers to execute arbitrary code in the context of the user running fish_config. The service is generally only running for short periods of time. fish version 2.1.1 restricts incoming connections to localhost only. At this stage, users should avoid running fish_config on systems where there are untrusted local users, as they are still able to connect to the fish_config service and elevate their privileges to those of the user running fish_config. No workaround is currently available for earlier versions of fish, although the use of the fish_config tool is optional as other interfaces to fish configuration are available. https://github.com/fish-shell/fish-shell/issues/1438 The patches going into 2.1.1 can be retrieved from the Integration_2.1.1 branch on Github if you would like to patch your own source or packages without updating to 2.1.1: https://github.com/fish-shell/fish-shell/tree/Integration_2.1.1 10642a34f17ae45bd93be3ae6021ee920d3da0c2 8412c867a501e3a68e55fef6215e86d3ac9f617b c0989dce2d882c94eb3183e7b94402ba53534abb Although at this stage we won't be issuing a 2.0.1 release, the patches have been backported to the 2.0.0 branch for distributions that would prefer not to upgrade to the 2.1 series: https://github.com/fish-shell/fish-shell/tree/Integration_2.0.1 216d32055d99fbae563ad048436830187a8bfceb aea9ad4965d24ef9c4e346f906194820bac70cc9 55986120aa2cc8ab0809db8ca1f8116491c1fb14 [1] http://www.openwall.com/lists/oss-security/2014/04/28/4
Also, according to the Debian bug report [2] there is another symlink-based vulnerability for which a CVE has not yet been assigned, and for which a patch will be available shortly. [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746259#10
Created fish tracking bugs for this issue: Affects: fedora-all [bug 1092092]
fish-2.1.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
(In reply to Vincent Danen from comment #1) > Also, according to the Debian bug report [2] there is another symlink-based > vulnerability for which a CVE has not yet been assigned, and for which a > patch will be available shortly. > > [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746259#10 This was assigned CVE-2014-3219: http://seclists.org/oss-sec/2014/q2/251
I believe that Fedora is now caught up with the appropriate Fish branch, and we have the fix for the change that was identified as relevant to CVE-2014-3219 on oss-sec, but I'm not really sure whether all known issues are fixed, so I'll leave this open until I get confirmation.
Please don't steal SRT bugs. This bug is specifically for CVE-2014-3219 -- if there are other issues, they will get their own CVEs and will have bugs opened for them as appropriate. This has been fixed in Fedora 19 and 20 (thank you!) so it can now be closed.