Re: ** FreeBSD local r00t zeroday

[David Berard <contact () davidberard fr>]

> The patch is at
>  http://people.freebsd.org/~cperciva/rtld.patch

This patch doesn't work under FreeBSD 7.x due to inexistant 
unsetenv(LD_ "ELF_HINTS_PATH"); in rtld.c


This patch seem to fix the issue on FreeBSD 7.x

--- /usr/src/libexec/rtld-elf/rtld.c    2008-11-25 03:59:29.000000000 +0100
+++ /usr/src/libexec/rtld-elf/rtld.c.new        2009-12-01 13:09:15.000000000 +0100
@@ -358,11 +358,12 @@
      * future processes to honor the potentially un-safe variables.
      */
     if (!trust) {
-        unsetenv(LD_ "PRELOAD");
-        unsetenv(LD_ "LIBMAP");
-        unsetenv(LD_ "LIBRARY_PATH");
-        unsetenv(LD_ "LIBMAP_DISABLE");
-        unsetenv(LD_ "DEBUG");
+           if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") ||
+                           unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") ||
+                           unsetenv(LD_ "DEBUG")) {
+                   _rtld_error("environment corrupt; aborting");
+                   die();
+           }
     }
     ld_debug = getenv(LD_ "DEBUG");
     libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;

Best Regards.

--
David BERARD
-------------------------------------------------
23 Boulevard MARENGO, Appartement A15
31500 TOULOUSE
contact(at)davidberard.fr
GPG|PGP KeyId 0xC8533354
GPG|PGP Key http://davidberard.fr/C8533354.gpgkey
-------------------------------------------------
*          No electrons were harmed in          *
*         the transmission of this email        *

Attachment: PGP.sig
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/