Full Disclosure mailing list archives
Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path
From: Tavis Ormandy <taviso () cmpxchg8b com>
Date: Wed, 20 Oct 2010 13:19:31 +0200
Louis Granboulan <louis.granboulan.security () gmail com> wrote:
However, it is quite clear to me that the current behaviour is inconsistent and is the reason of this security flaw. We see $ ls -l /proc/self/fd/3 pretend that it is a symbolic link to a file that does not exist, and $ ls -lL /proc/self/fd/3 show a setuid file.
Louis, the commands specified in the advisory were intended to help illustrate the problem, not be a replacement for any analysis. Your questions were anticipated, and answered in the Notes section. Next time I will put the Notes section at the top ;-) Tavis. -- ------------------------------------- taviso () cmpxchg8b com | pgp encrypted mail preferred ------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- The GNU C library dynamic linker expands $ORIGIN in setuid library search path Tavis Ormandy (Oct 18)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Pavel Kankovsky (Oct 18)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Marsh Ray (Oct 18)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Pavel Kankovsky (Oct 19)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Marsh Ray (Oct 18)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Hanno Böck (Oct 19)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Tavis Ormandy (Oct 19)
- <Possible follow-ups>
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Louis Granboulan (Oct 20)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Tavis Ormandy (Oct 20)
- Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path Pavel Kankovsky (Oct 18)