I was recently taking a look at the state of play regarding the security of POSIX runtime linkers and was pointed at the QNX Neutrino RTOS to take a look. In doing so I noticed a problem relating to the way that it handles LD_DEBUG_OUTPUT which allows for the creation or overwriting of an arbitrary file. Moreover the technique by which this can be achieved can be triggered even where the binary being executed is setUID and is running as another user.
Tim -- Tim Brown <mailto:t...@nth-dimension.org.uk> <http://www.nth-dimension.org.uk/>
NDSA20110310.txt.asc
Description: PGP signature
signature.asc
Description: This is a digitally signed message part.
