CVE-2014-3219 (published 2018-02-09T22:29Z)

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:L/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-59
cwe_name: Improper Link Resolution Before File Access ('Link Following')
description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/fish-shell/fish-shell
commit_details: repo_url: https://github.com/fish-shell/fish-shell
author: David Adam
author_date: 2014-04-28 23:37:02+08:00
msg: avoid symlink attacks in __fish_print_packages and spawning fishd

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches
 * when starting fishd, redirect fishd output to /dev/null, not a
   predictable path

Fix for CVE-2014-3219.

Closes #1440.
repository: repo_url: https://github.com/fish-shell/fish-shell
repo_name: fish-shell/fish-shell
description: The user-friendly command line shell.
repo_language: Rust
owner: fish-shell
file_changes: filename: env.cpp
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@
 #include "fish_version.h"
 
 /** Command used to start fishd */
-#define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
+#define FISHD_CMD L"fishd ^ /dev/null"
 
 // Version for easier debugging
 //#define FISHD_CMD L"fishd"

programming_language: C
filename: __fish_print_packages.fish
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,12 @@ function __fish_print_packages
 	#Get the word 'Package' in the current language
 	set -l package (_ Package)
 
+	# Set up cache directory
+	if test -z "$XDG_CACHE_HOME"
+		set XDG_CACHE_HOME $HOME/.cache
+	end
+	mkdir -m 700 -p $XDG_CACHE_HOME
+
 	if type -f apt-cache >/dev/null
 		# Do not generate the cache as apparently sometimes this is slow.
 		# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=547550
@@ -31,7 +37,7 @@ function __fish_print_packages
 
     # Caches for 5 minutes
 	if type -f pacman >/dev/null
-		set cache_file /tmp/.pac-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.pac-cache.$USER
 		if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))
@@ -51,7 +57,7 @@ function __fish_print_packages
 
 		# If the cache is less than six hours old, we do not recalculate it
 
-		set cache_file /tmp/.yum-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.yum-cache.$USER
 			if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))
@@ -73,7 +79,7 @@ function __fish_print_packages
 
 		# If the cache is less than five minutes old, we do not recalculate it
 
-		set cache_file /tmp/.rpm-cache.$USER
+		set cache_file $XDG_CACHE_HOME/.rpm-cache.$USER
 			if test -f $cache_file
 			cat $cache_file
 			set age (math (date +%s) - (stat -c '%Y' $cache_file))

programming_language: Shell