Bug#445595: Let's fix this for Lenny
Russell Coker
russell at coker.com.au
Sun Aug 10 10:43:08 UTC 2008
This is a two line patch that makes no actual code changes (it just changes
the labelling of the shared object header). The result of this change is the
same as running "execstack -c" on the shared object.
This patch improves system security. Without it any program that links to
that shared object (or any shared object that depends on it) will run with an
executable stack.
For example here is the difference in output between "paxtest kiddie"
and "LD_PRELOAD=/usr/lib/libsmpeg-0.4.so.0 paxtest kiddie":
< Executable stack : Killed
---
> Executable stack : Vulnerable
While it seems unlikely that someone would use LD_PRELOAD in such a manner in
any realistic attack situation, it is a good demonstration of the result of
having the shared object in question linked to the executable.
With my patch applied the result is that the "Executable stack" test gives a
result of "Killed". NB paxtest is an i386 only package, but I believe that
the same result applies to AMD64.
It would be quite embarrassing if Lenny was vulnerable to a security problem
because of this with the patch in the BTS for almost a year.
Would you like me to NMU it?
More information about the Pkg-sdl-maintainers
mailing list