CVE-2014-3219: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.8
Published: 2018-02-09T22:29Z
Repository: https://github.com/fish-shell/fish-shell
Language: C++
Files changed: env.cpp, share/functions/__fish_print_packages.fish
Commit date: 2014-05-12 09:30:05 +0800
Commit message: avoid symlink attacks in __fish_print_packages and spawning fishd

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches
 * when starting fishd, redirect fishd output to /dev/null, not a
   predictable path

Fix for CVE-2014-3219.

Closes #1440.

Diff: diff --git a/env.cpp b/env.cpp
index ff62a53f..086f181a 100644
--- a/env.cpp
+++ b/env.cpp
@@ -56,11 +56,11 @@
 
 #include "complete.h"
 #include "fish_version.h"
 
 /** Command used to start fishd */
-#define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
+#define FISHD_CMD L"fishd ^ /dev/null"
 
 // Version for easier debugging
 //#define FISHD_CMD L"fishd"
 
 /** Value denoting a null string */
diff --git a/share/functions/__fish_print_packages.fish b/share/functions/__fish_print_packages.fish
index ec812a64..6755dd6a 100644
--- a/share/functions/__fish_print_packages.fish
+++ b/share/functions/__fish_print_packages.fish
@@ -10,10 +10,16 @@ function __fish_print_packages
 	end
 
 	#Get the word 'Package' in the current language
 	set -l package (_ Package)
 
+	# Set up cache directory
+	if test -z "$XDG_CACHE_HOME"
+		set XDG_CACHE_HOME $HOME/.cache
+	end
+	mkdir -m 700 -p $XDG_CACHE_HOME
+
 	if type -f apt-cache >/dev/null
 		# Do not generate the cache as apparently sometimes this is slow.
 		# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547550
 		apt-cache --no-generate pkgnames (commandline -tc) ^/dev/null | sed -e 's/$/'\t$package'/'
 		return
@@ -29,11 +35,11 @@ function __fish_print_packages
 		return
 	end
 
     # Caches for 5 minutes
 	if type -f pacman >/dev/null
-		set cache_file /tmp/.pac-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.pac-cache.$USER
 		if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))
 			set max_age 250
 			if test $age -lt $max_age
@@ -49,11 +55,11 @@ function __fish_print_packages
 	# yum is slow, just like rpm, so go to the background
 	if type -f /usr/share/yum-cli/completion-helper.py >/dev/null
 
 		# If the cache is less than six hours old, we do not recalculate it
 
-		set cache_file /tmp/.yum-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.yum-cache.$USER
 			if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))
 			set max_age 21600
 			if test $age -lt $max_age
@@ -71,11 +77,11 @@ function __fish_print_packages
 
 	if type -f rpm >/dev/null
 
 		# If the cache is less than five minutes old, we do not recalculate it
 
-		set cache_file /tmp/.rpm-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.rpm-cache.$USER
 			if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))
 			set max_age 250
 			if test $age -lt $max_age

Vulnerable code: #define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
		set cache_file /tmp/.pac-cache.$USER
		set cache_file /tmp/.yum-cache.$USER
		set cache_file /tmp/.rpm-cache.$USER
Fixed code: #define FISHD_CMD L"fishd ^ /dev/null"
	# Set up cache directory
	if test -z "$XDG_CACHE_HOME"
		set XDG_CACHE_HOME $HOME/.cache
	end
	mkdir -m 700 -p $XDG_CACHE_HOME

		set cache_file $XDG_CACHE_HOME/.pac-cache.$USER
		set cache_file $XDG_CACHE_HOME/.yum-cache.$USER
		set cache_file $XDG_CACHE_HOME/.rpm-cache.$USER