Module Name:	pkgsrc
Committed By:	wiz
Date:		Thu Dec 14 11:55:04 UTC 2000

Modified Files:
	pkgsrc/security/fsh: Makefile
	pkgsrc/security/fsh/files: md5
	pkgsrc/security/fsh/pkg: PLIST

Log Message:
Update to 1.1 because of a possible security problem:
 The socket creation code in fshd was not paranoid enough.  There
 were are at least two possible attacks:
 - If a malicious user has symlinked /tmp/fshd-<UID> to another
   file, fshd will chmod 0700 that file.
 - A race condition made it possible for an attacker to create an
   unsafe socket directory, so that the attacker can access an
   fshd tunnel.
 The attacker must alread have a local shell on the computer where
 fsh or fshd is invoked.
Other changes:
New timeout option, fixed to work with openssh2, now also usable if
you have to enter a password to connect, and some others.


To generate a diff of this commit:
cvs rdiff -r1.1.1.1 -r1.2 pkgsrc/security/fsh/Makefile
cvs rdiff -r1.1.1.1 -r1.2 pkgsrc/security/fsh/files/md5
cvs rdiff -r1.1.1.1 -r1.2 pkgsrc/security/fsh/pkg/PLIST

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.