Check: GEN007960
HP-UX 11.31 STIG:
GEN007960
(in versions v1 r19 through v1 r13)
Title
The ldd command must be disabled unless it protects against the execution of untrusted files. (Cat II impact)
Discussion
The ldd command provides a list of dependent libraries needed by a given binary, which is useful for troubleshooting software. Instead of parsing the binary file, some ldd implementations invoke the program with a special environment variable set, which causes the system dynamic linker to display the list of libraries. Specially crafted binaries can specify an alternate dynamic linker which may cause a program to be executed instead of examined. If the program is from an untrusted source, such as in a user home directory, or a file suspected of involvement in a system compromise, unauthorized software may be executed with the rights of the user running ldd. Some ldd implementations include protections preventing the execution of untrusted files. If such protections exist, this requirement is not applicable. An acceptable method of disabling ldd is changing its mode to 0000. The SA may conduct troubleshooting by temporarily changing the mode to allow execution and running the ldd command as an unprivileged user upon trusted system binaries.
Check Content
Determine if the system's ldd executable exists and is executable. # ls -lL /usr/ccs/bin/ldd If the file exists and has any execute permissions, this is a finding.
Fix Text
Remove the execute permissions from the ldd executable. # chmod a-x /usr/ccs/bin/ldd
Additional Identifiers
Rule ID: SV-29540r1_rule
Vulnerability ID: V-23953
Group Title: GEN007960
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000305 |
The organization develops a list of software programs not authorized to execute on the information system. |
Controls
Number | Title |
---|---|
No controls are assigned to this check |