Arbitrary Code Execution With "ldd" 184
pkrumins writes "The ldd utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong! It turns out that running ldd on an executable can result in executing arbitrary code. This article details how such executable can be constructed and comes up with a social engineering scenario that may lead to system compromise. I researched this subject thoroughly and found that it's almost completely undocumented."
ldd pwned (Score:2, Funny)
Quickly! (Score:2, Funny)
Fetch me my tinfoil hat!
Re:ldd pwned (Score:5, Funny)
Uh, hello? Tech support?
You want me to do what with ldd?
Are you the same guy that told me to rm *? That wasn't funny....
Another WIN in WINdows (Score:5, Funny)
In Windows, we avoid this vulnerability by giving you absolutely no fricking clue what dependencies exist for any given DLL. Suck that Unix fanboys!
Re:the bug is not in ldd (Score:3, Funny)
So our lesson here is... don't run any scripts we don't fully understand as root. Thanks Slashdot - I feel so informed today!
Don't worry... (Score:3, Funny)
...I'm sure someone will find some other vulnerability.
Remember to Exit Stage Left (Score:5, Funny)
I researched this subject thoroughly and found that it's almost completely undocumented.
Completely undocumented... <CARUSO NAME="david" STYLE="csi/miami" SHADES="true"> ...until now. </CARUSO>
YEAAAAAAAAAH!
Re:Cool and so what (Score:5, Funny)
times like this, I just want to be able to say:
sandbox $whatever_command
and have it run in a completely safe environment.
[...] Or does such a thing exist?
A virtual machine you mean?
Re:the bug is not in ldd (Score:1, Funny)
How do I turn my PC into that drop box you're talking about. I have no interest in child porn, though... no none at all... yes, uh, uhm... it's for uhh... academic, yes academic purposes.... yeah
Rename it! (Score:4, Funny)
Re:the bug is not in ldd (Score:3, Funny)
Re:the bug is not in ldd (Score:5, Funny)