[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTikx=kMiVyssQk4qWPnBNsB+Fb4-1YaPifEWvSsA@mail.gmail.com>
Date: Thu, 21 Oct 2010 11:25:02 +0200
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Subject: Re: glibc $ORIGIN problem - CVE-2010-3847
> The actually exploitable impact of Tavis glibc $ORIGIN problem is still a bit open question.
>
> Apparently the bad code has a assert() in front which causes this assertion failure:
>
> $ LD_AUDIT=\$ORIGIN ping
> Inconsistency detected by ld.so: dl-open.c: 231: dl_open_worker: Assertion `(call_map)->l_name[0] == '\0'' failed!
> $
Yeah.. I looked into it as well on Ubuntu, and couldn't find any way
to bypass this assert(), but as you mentioned this code is.
h.o.r.r.i.b.l.e ;) so I wouldn't be surprised if there's a way to
exploit it.
--
Robert Święcki
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
