4 ms·
Ldd Arbitrary Code Execution
- mshockwave 5y ago> Lesson to be learned: Never run ldd on unknown executables! The lesson learned is legit, but I feel like this attack model is relatively weak. I think it will get more attention if it's `file` command rather than `ldd`. (btw all syntax highlighting in the article is broken)
- stevekemp 5y agoIt's not so long ago that `file` did have security issues (well libmagic): https://ubuntu.com/security/notices/USN-4172-1 https://ubuntu.com/security/notices/USN-4172-1 or: https://packetstormsecurity.com/files/127226/FreeBSD-Security-Advisory-file-libmagic.html https://packetstormsecurity.com/files/127226/FreeBSD-Securit...
- lunixbochs 5y agoArticle is dated 2009. Previous discussions: - [2009] https://news.ycombinator.com/item?id=902958 https://news.ycombinator.com/item?id=902958 - [2015] https://news.ycombinator.com/item?id=9629667 https://news.ycombinator.com/item?id=9629667