From owner-freebsd-security@FreeBSD.ORG Wed Mar 26 04:10:44 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4771037B404 for ; Wed, 26 Mar 2003 04:10:44 -0800 (PST) Received: from bran.mc.mpls.visi.com (bran.mc.mpls.visi.com [208.42.156.103]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7C05A43F3F for ; Wed, 26 Mar 2003 04:10:43 -0800 (PST) (envelope-from hawkeyd@visi.com) Received: from sheol.localdomain (hawkeyd-fw.dsl.visi.com [208.42.101.193]) by bran.mc.mpls.visi.com (Postfix) with ESMTP id 94AB849DC; Wed, 26 Mar 2003 06:10:42 -0600 (CST) Received: (from hawkeyd@localhost) by sheol.localdomain (8.11.6/8.11.6) id h2QCAfe17149; Wed, 26 Mar 2003 06:10:41 -0600 (CST) (envelope-from hawkeyd) Date: Wed, 26 Mar 2003 06:10:41 -0600 From: D J Hawkey Jr To: Simon Barner , "Jeremy C. Reed" Message-ID: <20030326061041.A17052@sheol.localdomain> References: <20030326102057.GC657@zi025.glhnet.mhn.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20030326102057.GC657@zi025.glhnet.mhn.de>; from barner@in.tum.de on Wed, Mar 26, 2003 at 11:20:57AM +0100 X-Spam-Status: No, hits=-31.8 required=5.0 tests=EMAIL_ATTRIBUTION,IN_REP_TO,QUOTED_EMAIL_TEXT, RCVD_IN_UNCONFIRMED_DSBL,REFERENCES,REPLY_WITH_QUOTES, USER_AGENT_MUTT autolearn=ham version=2.50 X-Spam-Level: X-Spam-Checker-Version: SpamAssassin 2.50 (1.173-2003-02-20-exp) cc: security at FreeBSD Subject: Re: what actually uses xdr_mem.c? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: hawkeyd@visi.com List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Mar 2003 12:10:45 -0000 On Mar 26, at 11:20 AM, Simon Barner wrote: > > Hi Jeremy, > > > The recent XDR fixes the xdrmem_getlong_aligned(), > > xdrmem_putlong_aligned(), xdrmem_getlong_unaligned(), > > xdrmem_putlong_unaligned(), xdrmem_getbytes(), and/or xdrmem_putbytes() > > functions, but it is difficult to know what uses these (going backwards > > manually). > > I would not rely on the binaries to find out, which programs make use of the > above functions. That's one of the advantages of an open source os ;-) > > Something like > > cd /usr/src > grep -rl 'xdrmem_getlong_aligned' * > > will print all the files that contain the string 'xdrmem_getlong_aligned'. Based > on the path name of those file, you will be able to find out which programs use > the xdr* functions. Actually, I _would_ check the binaries. Scanning /usr/src doesn't cover anything installed via the ports collection (/usr/ports), from other sources, or "home-grown" software. A week or so ago, I posted a command that scans the binaries: find $DIR -type f \ |xargs readelf -a 2>/dev/null \ |awk '/^File:/ { name = $2; printed = 0; } \ /XDR|xdr/ { if (!printed) { print name; printed = 1; } }' \ |xargs ldd 2>/dev/null If it reports a pathed file without listing any shared libraries, then it is statically-linked. I can't say this is the definitive answer, but it worked in a controlled environment (i.e., known binaries), as well as a live system. You can break down it's components to see what each pipe does. > HTH, > Simon HTH too, Dave -- ______________________ ______________________ \__________________ \ D. J. HAWKEY JR. / __________________/ \________________/\ hawkeyd@visi.com /\________________/ http://www.visi.com/~hawkeyd/