[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201008291611.20457.timb@nth-dimension.org.uk>
Date: Sun, 29 Aug 2010 16:10:48 +0100
From: Tim Brown <timb@...-dimension.org.uk>
To: oss-security@...ts.openwall.com
Subject: Hardening the linker (was Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only))
For those of you that missed it, this was actually reported by Dan off the back
of a blog post by me describing the generic case:
http://www.nth-dimension.org.uk/blog.php?id=87
I'm well aware that the linker is a tool and that it can be misused (as in
this case) but is anyone aware of a good reason why empty directory
specifications in LD_LIBRARY_PATH, PATH et al are treated as $PWD? The only
times I've seen empty specifications it's because of bugs such as the one Dan
has reported.
Is there a case to look at harding the dynamic linker to reject empty
specifications; there's not much that one can do where someone has explicitly
set a stupid LD_LIBRARY_PATH? I appreciate that this might has some unwanted
outcomes (such as breaking compatibility with other POSIX-alike OS) but
sometimes there's a good argument for breaking compatibility if it increases
security (some of the various grsec kernel and GCC compiler hardening changes
would be good examples here).
Tim
--
Tim Brown
<mailto:timb@...-dimension.org.uk>
<http://www.nth-dimension.org.uk/>
Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
