Bug#598303: tau: CVE-2010-3382: insecure library loading

[Julien Cristau]

On Wed, Oct  6, 2010 at 11:37:15 +0000, Aníbal Monsalve Salazar wrote:

> > Yay overengineering.
> > 
> > What's wrong with a simple
> > export 
> > LD_LIBRARY_PATH="$TAUROOT/$TAUARCH/lib/$thebinding${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
> > ?
> 
> In the general case where you have a $foo before
> ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}
> the result is not good if $foo is empty.
> 
> See for example:
> 
> set -x
> LD_LIBRARY_PATH="/lib"; 
> LD_LIBRARY_PATH="$foo${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
> + LD_LIBRARY_PATH=/lib
> + LD_LIBRARY_PATH=:/lib

This makes absolutely no sense.  "$TAUROOT/$TAUARCH/lib/$thebinding is
not empty.

Cheers,
Julien

signature.asc
Description: Digital signature