Julien Cristau <jcris...@debian.org> writes:
> On Mon, Oct 18, 2010 at 13:42:43 +0300, Jari Aalto wrote:
>
>> + * debian/vdrleaktest
>> + - Remove extra colon from LD_LIBRARY_PATH and improve security
>> + by cleaning LD_LIBRARY_PATH with new function Pathclean().
>> + (normal, security, reopened; Closes: #598308).
>> +
>
> That's not "improve security", that's "add obfuscation". Just remove
> the freaking colon...
Removing the colon does not address this:
(
LD_LIBRARY_PATH="::"
LD_LIBRARY_PATH="/usr/lib/debug${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
echo $LD_LIBRARY_PATH
)
# /usr/lib/debug:::
as far as security is concerned:
(
Pathclean ()
{
# Vulnerability fix for insecure library loading
# Make sure "::", "^:" or ":$" is not left in path arg $1
local tmp123xyz
tmp123xyz=$(echo "$1" | sed -e 's/::\+// ; s/^:// ; s/:$//' )
[ "$tmp123xyz" ] && echo "$tmp123xyz"
}
LD_LIBRARY_PATH="::"
LD_LIBRARY_PATH="/usr/lib/debug${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
echo "before: $LD_LIBRARY_PATH"
echo -n "after: "
Pathclean "$LD_LIBRARY_PATH"
)
# before: /usr/lib/debug:::
# after: /usr/lib/debug
Raphael, you reported the CVE. Do you have any thoughts?
Jari
P.s noticed a slight bug in resent NMU concerning Pathclean().
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
