From owner-freebsd-security@FreeBSD.ORG Wed Mar 26 21:22:14 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A19ED37B404 for ; Wed, 26 Mar 2003 21:22:14 -0800 (PST) Received: from mailman.zeta.org.au (mailman.zeta.org.au [203.26.10.16]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4B07B43FA3 for ; Wed, 26 Mar 2003 21:22:13 -0800 (PST) (envelope-from bde@zeta.org.au) Received: from katana.zip.com.au (katana.zip.com.au [61.8.7.246]) by mailman.zeta.org.au (8.9.3/8.8.7) with ESMTP id QAA24970; Thu, 27 Mar 2003 16:22:06 +1100 Date: Thu, 27 Mar 2003 16:22:05 +1100 (EST) From: Bruce Evans X-X-Sender: bde@gamplex.bde.org To: Uros Juvan In-Reply-To: <3E81AF6C.3060705@arnes.si> Message-ID: <20030327160638.J1404@gamplex.bde.org> References: <20030326061041.A17052@sheol.localdomain> <20030326071637.A17385@sheol.localdomain> <3E81AF6C.3060705@arnes.si> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Status: No, hits=-26.1 required=5.0 tests=AWL,EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, REFERENCES,REPLY_WITH_QUOTES autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) cc: security at FreeBSD Subject: Re: what actually uses xdr_mem.c? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2003 05:22:17 -0000 On Wed, 26 Mar 2003, Uros Juvan wrote: > Idea is cool, but it just won't work on staticaly linked files, you can > test this with: > > # readelf -a /bin/ls > > for example :( > > I don't think there is 100% way of telling whether staticaly linked file > is linked against vulnerable xdr_mem.o, especially because obviously > rcsid string is undefined in source file. This isn't so obvious: %%% Script started on Thu Mar 27 16:07:33 2003 ttyp0:bde@besplex:/tmp> strings -a /bin/ls | grep xdr_mem $FreeBSD: src/lib/libc/xdr/xdr_mem.c,v 1.11 2002/03/22 21:53:26 obrien Exp $ ttyp0:bde@besplex:/tmp> exit Script done on Thu Mar 27 16:07:44 2003 %%% (strings -a shows a few other interesting strings and lots of bloat.) xdr_mem.c has always had some sort of id string, but putting the string in the object file was broken for many years by putting the rcsid in the LIBC_SCCS section and then renaming LIBC_SCCS to LIBC_RCS in the Makefile without adjusting any source files that had ids. This was fixed relatively recently in -current but is still broken in RELENG_4. Bruce