bugtraq - Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 1 May 2003 14:05:07 -0500 (CDT)
From: Ben Lindstrom <mouring@...h.eviladmin.org>
To: Shiva Persaud <shivapd@...ibm.com>
Cc: Damien Miller <djm@...drot.org>, <BUGTRAQ@...urityfocus.com>,
	OpenSSH Development <openssh-unix-dev@...drot.org>
Subject: Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv)



On Thu, 1 May 2003, Shiva Persaud wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Taken from IBM's AIX vendor response (http://lists.insecure.org/lists/bugtraq/2000/Mar/0184.html) to this issue when discussed in 2000:
>
>
> <BEGIN>
> The AIX version 4 linker has always documented the -blibpath option as a
> mechanism for removing build environment dependencies from a runtime
> environment. Applications that gain privilege should always use this
> option to remove library search paths that may not/should not exist on
> customer machines.
>
>
> The use of relative library paths is also highly discouraged. While
> they can be useful, the -blibpath option should also be used to not only
> avoid these types of security issues, but to remove the possibility of
> finding (or not finding at all) the wrong relative directory, since
> relative paths at runtime will be based upon the current working
> directory.
>
>

Summary version:  "We feel we are right even if it is a bad 'feature' to
have on by default."

I find this view to be pretty bullshit response that shows lack of real
world development experience.  Dangerous features should require enabling
not disabling.

I'm very disappointed in this choice by IBM.

- Ben