Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv)

From: Damien Miller (djm_at_mindrot.org)
Date: 05/01/03

  • Next message: Cisco Systems Product Security Incident Response Team: "Cisco Security Advisory: Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 Nessus Vulnerabilities" 
    Date: Thu, 01 May 2003 09:26:44 +1000
To: Valdis.Kletnieks@vt.edu, bugtraq@securityfocus.com

    Valdis.Kletnieks@vt.edu wrote:
    > On Wed, 30 Apr 2003 13:39:49 +1000, Damien Miller <djm@mindrot.org> said:
    >
    >>1. Systems affected:
    >>
    >> Users of Portable OpenSSH prior to 3.6.1p2 on AIX are affected
    >> if OpenSSH was compiled using a non-AIX compiler (e.g. gcc).
    >
    >
    > This is the same problem as I spotted in Sendmail 8.10. Basically,
    > somewhere, linking is being done with "-L. -lfoo" or similar (in sendmail's
    > case, it was -L../otherdir type stuff).
    >
    > Workaround/fix: Link with "-bnolibpath -blibpath:/usr/local/lib:/usr/lib"
    > or similar.

    This is what we have done for a long time, but those options only work
    when using xlc as the linker, with gcc you need to specify different
    options.

    3.6.1p2 specifies these options correctly, but it illustrates the deeper
    problem: the default is insecure and you need to add workarounds for
    each additional interface to the linker.

    I wouldn't be suprised if this affected binaries built with libtool or
    other wrappers, though I haven't checked (we don't use them).

    -d

  • Next message: Cisco Systems Product Security Incident Response Team: "Cisco Security Advisory: Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 Nessus Vulnerabilities"

    Relevant Pages

    • Re: What are the domains that lisp doesnt fit int?
      ... There's no way to specify that in Standard C, ... Normally one places functions using the linker - it may not be ... valid code addresses overlap valid data addresses ... ... The trick is to find the extent of the code you want to copy - C lets ...
      (comp.lang.lisp)
    • Re: Typical handling of packages through compilers
      ... It's the lack of a proper smart linking in the GNU linker. ... When you specify these options, ... create larger object and executable files and will also be slower. ...
      (comp.lang.ada)
    • Re: function-sections and data-sections option in gcc
      ... Place each function or data item into its own section in the output file if the target supports arbitrary sections. ... Use these options on systems where the linker can perform optimizations to improve locality of reference in the instruction space. ... You will not be able to use gprof on all systems if you specify this option and you may have problems with debugging if you specify both this option and -g. ...
      (comp.lang.c)
    • Re: Searching for non-standard shared libraries
      ... > If I have a shared library that isn't in the standard 'libxxx.so' ... how do I specify it to the linker such ... > with non-std named libraries, ... > a shared library as input to the linker such that you don't have to ...
      (comp.unix.solaris)
    • Re: Hidden implementation?
      ... the linker looks for a function with the specified name in both the specified modules and the libraries which you specify. ... If you want to prevent the linker from satisfying the call to show_line, declare show_lineas static, as Chuck suggests. ...
      (comp.lang.c)
    Loading