fsh is a tool to quickly run remote commands over rsh/ssh/lsh. Colin Phipps found an interesting symlink attack against the way fsh creates temporary files. This enables local users to overwrite arbitrary files on the system.
When fshd starts it creates a directory in /tmp to hold its sockets. It tries to do that securely by checking if it cans chown that directory (if it already exists) to ensure that the user invoking it owns it.
However, an attacker can circumvent this check by inserting a symlink to a file that is owned by the user who runs fshd and replacing that with a directory just before fshd creates the socket.
Fix:
This has been fixed in version 1.0.post.1-3potato.
wget url
will fetch the file for you dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
