From owner-freebsd-security@FreeBSD.ORG Wed Mar 26 06:38:17 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7F0D437B404; Wed, 26 Mar 2003 06:38:17 -0800 (PST) Received: from bran.mc.mpls.visi.com (bran.mc.mpls.visi.com [208.42.156.103]) by mx1.FreeBSD.org (Postfix) with ESMTP id 84F4243F3F; Wed, 26 Mar 2003 06:38:16 -0800 (PST) (envelope-from hawkeyd@visi.com) Received: from sheol.localdomain (hawkeyd-fw.dsl.visi.com [208.42.101.193]) by bran.mc.mpls.visi.com (Postfix) with ESMTP id 9F0E24F9E; Wed, 26 Mar 2003 08:38:15 -0600 (CST) Received: (from hawkeyd@localhost) by sheol.localdomain (8.11.6/8.11.6) id h2QEcFW18008; Wed, 26 Mar 2003 08:38:15 -0600 (CST) (envelope-from hawkeyd) Date: Wed, 26 Mar 2003 08:38:14 -0600 From: D J Hawkey Jr To: "Jacques A. Vidrine" , Simon Barner , "Jeremy C. Reed" , security at FreeBSD Message-ID: <20030326083814.E17610@sheol.localdomain> References: <20030326102057.GC657@zi025.glhnet.mhn.de> <20030326061041.A17052@sheol.localdomain> <20030326141024.GD33671@madman.celabo.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20030326141024.GD33671@madman.celabo.org>; from nectar@FreeBSD.org on Wed, Mar 26, 2003 at 08:10:24AM -0600 X-Spam-Status: No, hits=-31.3 required=5.0 tests=AWL,EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, RCVD_IN_UNCONFIRMED_DSBL,REFERENCES,REPLY_WITH_QUOTES, USER_AGENT_MUTT autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) Subject: Re: what actually uses xdr_mem.c? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: hawkeyd@visi.com List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Mar 2003 14:38:18 -0000 On Mar 26, at 08:10 AM, Jacques A. Vidrine wrote: > > On Wed, Mar 26, 2003 at 06:10:41AM -0600, D J Hawkey Jr wrote: > > > > find $DIR -type f \ > > |xargs readelf -a 2>/dev/null \ > > |awk '/^File:/ { name = $2; printed = 0; } \ > > /XDR|xdr/ { if (!printed) { print name; printed = 1; } }' \ > > |xargs ldd 2>/dev/null > > > > If it reports a pathed file without listing any shared libraries, then > > it is statically-linked. > > This approach won't work for static binaries (which is what the poster > was inquiring about). So someone else has proven to me. > It also will fail you in this case. Since (most) affected binaries do > not call xdrmem_* directly, those names will not appear in the > binaries' symbol tables. (Although related names might, which may or > may not be enough for you to go on.) As I replied to him, thanks for hitting me with the Clue Stick. Are my posts _really_ making it to freebsd-security? The archive web page shows nothing at all for today, majordomo says I'm not subscribed anymore, yet I'm getting replies from folk I haven't sent to directly. If not, I suppose I'll have to re-post my replies? Maybe after trying to re-subscribe? stumblemumblegrumble Dave -- ______________________ ______________________ \__________________ \ D. J. HAWKEY JR. / __________________/ \________________/\ hawkeyd@visi.com /\________________/ http://www.visi.com/~hawkeyd/