Re: Injectso to help with libc upgrades?
On Wed, Apr 30, 2003 at 12:07:33PM -0500, Drew Scott Daniels wrote:
> http://packetstorm.linuxsecurity.com/filedesc/injectso-0.2.1.tar.html
> describes injectso, "a tool that can be used to inject shared libraries
> into running processes on Linux (x86/IA32 and Sparc)...".
>
> Maybe I misunderstand, but might it not be also possible to use this to
> inject replacements for shared libraries too?
Not reliably. Even if you can replace the code in the process's
memory space, what if some data structures have changed and the
program already has some objects allocated? There are doubtless
other issues as well (what if the old code is still in a cache?).
I'm sure you could concoct something that works "almost all" the
time, given some restrictions, like no changes to data structures.
But I almost guarantee that the security team will say 1) we don't
have time to verify the restrictions, and 2) "almost all" isn't good
enough.
Andrew
PS. Your Mail-Followup-To: header should include the list address.
Reply to: