Ldd Arbitrary Code Execution

[zdw]

https://catonmat.net/ldd-arbitrary-code-execution

[lunixbochs]

Article is dated 2009.

Previous discussions:

- [2009] https://news.ycombinator.com/item?id=902958

- [2015] https://news.ycombinator.com/item?id=9629667

[mshockwave]

> Lesson to be learned: Never run ldd on unknown executables!

The lesson learned is legit, but I feel like this attack model is relatively weak. I think it will get more attention if it's `file` command rather than `ldd`. (btw all syntax highlighting in the article is broken)

[stevekemp → mshockwave]

It's not so long ago that `file` did have security issues (well libmagic):

https://ubuntu.com/security/notices/USN-4172-1

or:

https://packetstormsecurity.com/files/127226/FreeBSD-Securit...