SECURITY INFO

Finally, after months after security bug in fspd was found and fixed, the bug info (and working exploit) was released into public. Here you can find some details.

fspd: Remotely exploitable buffer overflow and directory traversal bugs

Read http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1022, http://www.debian.org/security/2004/dsa-416, http://xforce.iss.net/xforce/xfdb/14155, http://xforce.iss.net/xforce/xfdb/14154, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0011.

This security problem was fixed in FSP 2.8.1 Beta6 (2-Jun-2003). Information in linked reports, that you must have beta18 for fixing this problem, is wrong. For some unknown reasons both parties refused to correct this.

Versions 2.8.1 Beta11-Beta13, have another minor security problem that CC_STAT can stat any file outside fsp directory root. You must have modified fstatcmd and client library if you want to exploit this bug; this do not works with stock distro.

FSPLIB Buffer overflow

Buffer overflow in fsplib was found by David Binderman. Fixed in version 0.8

FSPLIB didnt checked strings returned by server enough. Server sending non \0 terminated strings (violation of FSP protocol) could cause client to segfault and possibly executing of injected code. Fixed in version 0.9. See also Secunia.com advisory