Unfortunate dynamic linking for everything
das at FreeBSD.ORG
Tue Nov 18 20:09:18 PST 2003
On Tue, Nov 18, 2003, Scott Long wrote:
> > The additional hole of exploiting the system through the shared libs
> > is a negative tradeoff.
> Exploits in libraries happen though. The LD_LIBRARY_PATH attack is an old
> one that most Unixes are hopefully hardened against.
FreeBSD had a lingering LD_LIBRARY_PATH-related vulnerability
until Sunday, actually. ;-) But I don't mean to dispute your
point. Like most of the other arguments in this bikeshed, there
is nothing fundamental about the LD_LIBRARY_PATH problem---nothing
that can't be fixed easily.
 The bug is either that nologin(8) respected LD_LIBRARY_PATH or
that sshd(8) and login(1) allow environment poisoning, depending
on your point of view.
More information about the freebsd-current