On Sun, 24 Oct 2010 11:38:27 -0400, Drew Ames <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi all, > > Here's an interesting security update from Slackware that gives some > information on a recent vulnerability exposed in Glibc: > > glibc-2.11.1-i486-4_slack13.1.txz: Rebuilt. > Patched "dynamic linker expands $ORIGIN in setuid library > search path". > This security issue allows a local attacker to gain root if > they can create > a hard link to a setuid root binary. Thanks to Tavis Ormandy. > For more information, see: > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3847 > http://seclists.org/fulldisclosure/2010/Oct/257 > (* Security fix *) > > The seclist.org link is particularly interesting since it explains the > vulnerability in detail. > > What's the implication for LFS?
I can't see any reason why LFS systems would not be impacted by this vulnerability. > 1) Is it worth downloading and using the development version of Glibc > from git://sourceware.org/git/glibc.git to build LFS with the updated > source? I wouldn't be keen building from the latest development version myself. I'm more cautious than that (especially for toolchain packages), so would advise to build 2.12.1 + patch for this bug. Finding such patches can take some time, but this one was pretty easy: http://sourceware.org/ml/libc-hacker/2010-10/msg00007.html. > 3) How do you folks handle security issues like this? The question you have to ask yourself is "am I affected by this?". i.e. on your particular system, is there a possibility that this bug can be triggered. Quoting from the vulnerability description above: "This security issue allows a local attacker to gain root if they can create a hard link to a setuid root binary." So, on your system, is that possible? On mine, I happen to be the only user, I don't run sshd or any other remotely accessible services, so I don't happen to be affected by this bug. >From an LFS perspective, I think we should try to address this by applying the patch linked to above. Drew, as your middway through your build, but at a convenient place, you could apply the patch above to your chapter 6 build and you should be safe from this particular flaw. Regards, Matt. -- http://linuxfromscratch.org/mailman/listinfo/lfs-dev FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page
