Bugzilla – Bug 58909
VUL-0: CVE-2004-1453: glibc: Information leak with LD_DEBUG
Last modified: 2021-10-04 09:54:10 UTC
Gentoo has issued an advisory: http://www.gentoo.org/security/en/glsa/glsa-200408-16.xml "An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precendence over those symbols to gain information or perform further exploitation." Sounds rather weird to me.
Sounds like bullshit to me. I don't need LD_DEBUG to gather this informations. And how should using a trojaned library work? You cannot preload a library or modify the searchpath for a suid application. And I cannot find a mail or patch which should change something in this area. Without more informations, there is nothing I can do.
I don't know more than they state in their advisory. This seems to be the patch they used: http://www.gentoo.org/cgi-bin/viewcvs.cgi/sys-libs/glibc/files/glibc-sec-hotfix-20040804.patch?rev=1.1&content-type=text/vnd.viewcvs-markup If it's bullshit then so it be. It's Gentoo you know ... ;-)
The malloc part is bogus. Don't know about the second part, but it was never send upstream to glibc developers. And the patch was not made against the CVS version we are using, seems this is a much older version (maybe the last official release? I don't know).
Ok, got an answer from main glibc hackers: "LD_DEBUG=all doesn't give you exact addresses of symbols (but LD_TRACE_PRELINKING=1 does, maybe we should turn that off for __libc_enable_secure and missing /etc/suid-debug). It only tells you which libraries' symbols are used. Andou can't LD_PRELOAD a trojaned library to a suid binary (unless it is in the standard paths and sgid I think) nor you can use LD_LIBRARY_PATH to trick it in any way." The "fix" itself is wrong.
Thorsten, do you think it's worth to add these two variables to the list of ignored variables for setuid applications (#define UNSECURE_ENVVARS) for the next release?
No, what sense should this have?
Created attachment 22786 [details] typescript For the case when a setuid binary is protected by permissions 4711 and you are not able to read the symbols (like using nm) you can get the desired informations using LD-DEBUG=all.
It is no big deal for sure but it may be nice to have it included.
I suggest fixing it in STABLE / upstream CVS.
CAN-2004-1453
CVE-2004-1453: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)