The ldd command must be disabled unless it protects against the execution of untrusted files.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000305

SV-63379r1_rule The ldd command must be disabled unless it protects against the execution of untrusted files.

Vulnerability discussion

The 'ldd' command provides a list of dependent libraries needed by a given binary, which is useful for troubleshooting software. Instead of parsing the binary file, some 'ldd' implementations invoke the program with a special environment variable set, which causes the system dynamic linker to display the list of libraries. Specially crafted binaries can specify an alternate dynamic linker which may cause a program to be executed instead of examined. If the program is from an untrusted source, such as in a user home directory, or a file suspected of involvement in a system compromise, unauthorized software may be executed with the rights of the user running 'ldd'. Some 'ldd' implementations include protections that prevent the execution of untrusted files. Recent glibc RPMs delivered by this operating system also protect against the execution of untrusted files. If such protections exist, this requirement is not applicable.An acceptable method of disabling 'ldd' is changing its mode to 0000. The SA may conduct troubleshooting by temporarily changing the mode to allow execution and running the 'ldd' command as an unprivileged user upon trusted system binaries.

Check content

Check the system for the 'ldd' binary. Procedure: # ls -lL /usr/bin/ldd If the 'ldd' binary has any executable permissions bits set, this is a finding.

Fix text

Remove the execute permissions from the 'ldd' executable. Procedure: # chmod a-x /usr/bin/ldd

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.