Test ID:	1.3.6.1.4.1.25623.1.0.53768
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 002-1 (fsh)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to fsh announced via advisory DSA 002-1. Colin Phipps found an interesting symlink attack problem in fsh (a tool to quickly run remote commands over rsh/ssh/lsh). When fshd starts it creates a directory in /tmp to hold its sockets. It tries to do that securely by checking of it can chown that directory if it already exists to check if it is owner by the user invoking it. However an attacker can circumvent this check by inserting a symlink to a file that is owner by the user who runs fhsd and replacing that with a directory just before fshd creates the socket. This has been fixed in version 1.0.post.1-3potato. Solution: http://www.securityspace.com/smysecure/catid.html?in=DSA%20002-1 CVSS Score: 7.2 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.