ldd arbitrary code execution

You're viewing a comment by Gaspar and its responses.

Gaspar Permalink
October 26, 2009, 18:22

@Peteris Krumins

From the MAN page:

Usage

Security

A superuser should use the -f option only if the executable to be examined is known to be trustworthy. The use of -f on an untrustworthy executable while superuser can compromise system security. If an executables trustworthyness is unknown, a superuser should temporarily become a regular user. Then invoke ldd as this regular user.

If you google it you can find this issue several times in the first few pages.

If you CHECK THE DOCUMENTATION for ldd, this issue is mentioned. Granted you have to read through a bunch first. But it is very clearly documented.

Reply to this comment

Reply To This Comment

(why do I need your e-mail?)

(Your twitter name, if you have one. (I'm @pkrumins, btw.))

Comment Help

Type first 3 letters of your name: (just to make sure you're a human)

Please preview the comment before submitting to make sure it's OK.