LSH Seed File File Descriptor Leakage Vulnerability

Bugtraq ID:	16357
Class:	Access Validation Error
CVE:	CVE-2006-0353
Remote:	No
Local:	Yes
Published:	Jan 23 2006 12:00AM
Updated:	Aug 16 2006 04:10PM
Credit:	Discovered by Stefan Pfetzing.
Vulnerable:	LSH LSH 2.0.1 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:

LSH Seed File File Descriptor Leakage Vulnerability

lsh may leak file descriptors that may allow a local attacker to access sensitive information or to cause a denial-of-service condition.

lsh 2.0.1 is reportedly vulnerable. Other versions may be affected as well.

LSH Seed File File Descriptor Leakage Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

LSH Seed File File Descriptor Leakage Vulnerability

Solution:
The vendor has released a source-code patch to address this issue. The patch is available from the following location:

http://lists.lysator.liu.se/pipermail/lsh-bugs/2006q1/000467.html

Debian has released advisory DSA 956-1 to address this issue. Please see the referenced advisory for more information.


LSH LSH 2.0.1

• Debian lsh-client_2.0.1-3sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_alpha.deb


• Debian lsh-client_2.0.1-3sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_arm.deb


• Debian lsh-client_2.0.1-3sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_hppa.deb


• Debian lsh-client_2.0.1-3sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_i386.deb


• Debian lsh-client_2.0.1-3sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_ia64.deb


• Debian lsh-client_2.0.1-3sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_m68k.deb


• Debian lsh-client_2.0.1-3sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_mips.deb


• Debian lsh-client_2.0.1-3sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_mipsel.deb


• Debian lsh-client_2.0.1-3sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_powerpc.deb


• Debian lsh-client_2.0.1-3sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_s390.deb


• Debian lsh-client_2.0.1-3sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2. 0.1-3sarge1_sparc.deb


• Debian lsh-server_2.0.1-3sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_alpha.deb


• Debian lsh-server_2.0.1-3sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_arm.deb


• Debian lsh-server_2.0.1-3sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_hppa.deb


• Debian lsh-server_2.0.1-3sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_i386.deb


• Debian lsh-server_2.0.1-3sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_ia64.deb


• Debian lsh-server_2.0.1-3sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_m68k.deb


• Debian lsh-server_2.0.1-3sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_mips.deb


• Debian lsh-server_2.0.1-3sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_mipsel.deb


• Debian lsh-server_2.0.1-3sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_powerpc.deb


• Debian lsh-server_2.0.1-3sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_s390.deb


• Debian lsh-utils-doc_2.0.1-3sarge1_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils-doc _2.0.1-3sarge1_all.deb


• Debian lsh-utils/lsh-server_2.0.1-3sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2. 0.1-3sarge1_sparc.deb


• Debian lsh-utils/lsh-utils_2.0.1-3sarge1_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_powerpc.deb


• Debian lsh-utils_2.0.1-3sarge1_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_alpha.deb


• Debian lsh-utils_2.0.1-3sarge1_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_arm.deb


• Debian lsh-utils_2.0.1-3sarge1_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_hppa.deb


• Debian lsh-utils_2.0.1-3sarge1_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_i386.deb


• Debian lsh-utils_2.0.1-3sarge1_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_ia64.deb


• Debian lsh-utils_2.0.1-3sarge1_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_m68k.deb


• Debian lsh-utils_2.0.1-3sarge1_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_mips.deb


• Debian lsh-utils_2.0.1-3sarge1_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_mipsel.deb


• Debian lsh-utils_2.0.1-3sarge1_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_s390.deb


• Debian lsh-utils_2.0.1-3sarge1_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0 .1-3sarge1_sparc.deb

LSH Seed File File Descriptor Leakage Vulnerability

References:

• DSA-956-1 lsh-server -- filedescriptor leak (Debian)
  
• Home Page (InstallShield)
  
• lshd leaks fd:s to user shells (Niels Möller)