Date: Sun, 29 Aug 2010 16:10:48 +0100 From: Tim Brown <timb@...-dimension.org.uk> To: oss-security@...ts.openwall.com Subject: Hardening the linker (was Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only)) For those of you that missed it, this was actually reported by Dan off the back of a blog post by me describing the generic case: http://www.nth-dimension.org.uk/blog.php?id=87 I'm well aware that the linker is a tool and that it can be misused (as in this case) but is anyone aware of a good reason why empty directory specifications in LD_LIBRARY_PATH, PATH et al are treated as $PWD? The only times I've seen empty specifications it's because of bugs such as the one Dan has reported. Is there a case to look at harding the dynamic linker to reject empty specifications; there's not much that one can do where someone has explicitly set a stupid LD_LIBRARY_PATH? I appreciate that this might has some unwanted outcomes (such as breaking compatibility with other POSIX-alike OS) but sometimes there's a good argument for breaking compatibility if it increases security (some of the various grsec kernel and GCC compiler hardening changes would be good examples here). Tim -- Tim Brown <mailto:timb@...-dimension.org.uk> <http://www.nth-dimension.org.uk/> Download attachment "signature.asc " of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.