Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [ GLSA 200408-16 ] glibc: Information leak with LD_DEBUG

from [Jim Paris] Network Security [Permanent Link]
Subject: Re: [ GLSA 200408-16 ] glibc: Information leak with LD_DEBUG
Date: Fri, 20 Aug 2004 03:24:53 -0400 
Silvio Cesare discovered a potential information leak in glibc. It
allows LD_DEBUG on SUID binaries where it should not be allowed. This
has various security implications, which may be used to gain
confidentional information.


It's worse than that.  You can essentially single-step through the
library calls of a binary by turning on verbose debugging through
LD_DEBUG and then carefully controlling stdout so that the program
blocks while writing the debugging output.  I've used this to exploit
race conditions in setuid binaries that would otherwise be nearly
impossible to trigger.

Gentoo's method of adding LD_DEBUG to UNSECURE_ENVVARS will prevent
this.

-jim
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  What A Drag II XP SP2, http-equiv@excite.com
Next by Date:  Re: [ GLSA 200408-19 ] courier-imap: Remote Format String Vulnerability, infamous41md
Previous by Thread:  [Full-Disclosure] [ GLSA 200408-16 ] glibc: Information leak with LD_DEBUG, Kurt Lieber
Next by Thread:  Re: [ GLSA 200408-16 ] glibc: Information leak with LD_DEBUG, Solar Designer
Indexes:  [Date] [Thread] [Top] [All Lists]