bugtraq - Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 01 May 2003 11:48:23 +1000
From: Darren Tucker <dtucker@....com.au>
To: Valdis.Kletnieks@...edu
Subject: Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv)


Valdis.Kletnieks@...edu wrote:
> On Wed, 30 Apr 2003 13:39:49 +1000, Damien Miller <djm@...drot.org>  said:
> > 1. Systems affected:
> >
> >       Users of Portable OpenSSH prior to 3.6.1p2 on AIX are affected
> >       if OpenSSH was compiled using a non-AIX compiler (e.g. gcc).
> 
> This is the same problem as I spotted in Sendmail 8.10.  Basically,
> somewhere, linking is being done with "-L. -lfoo" or similar (in sendmail's
> case, it was -L../otherdir type stuff).

Yes, and your sendmail advisory was one of the sources of information I
used when preparing the fix.

> Workaround/fix:  Link with "-bnolibpath -blibpath:/usr/local/lib:/usr/lib"
> or similar.

OpenSSH already specified -blibpath *EXCEPT* when CC=gcc (thus, binaries
compiled with xlc were safe).  GCC doesn't understand -blibpath.

Configure now tries using -blibpath, -Wl,-blibpath and -Wl,-rpath (for
xlc, GCC + native ld and GCC + GNU ld respectively).  If none of these
work it will abort.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG Fingerprint D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.