RE: [gentoo-security] Do I need to rebuild things after upgrading ssl?

[Joel Osburn]

Quoting Marc Bellarin:
>To find packages that had the static flag set when built run
>
># grep -r static /var/db/*| grep \/USE
>
>(This is no "V" but "\ /" !)

As you say, this just find packages that were compiled using the
'static' flag.

A developer may have their own reasons for insisting that their program
be statically compiled against a particular library.  In such a case,
you don't get to choose.  The last time there was an openssl
vulnerability, I discovered that one of my machines (still using
apache-1.3.x, so using mod_ssl) was vulnerable *after* I had updated
openssl.  I wasn't the only one on the list who had that problem.  I've
never used the static flag, but mod_ssl was statically compiled against
openssl, and thus had to be re-compiled.  No separate GLSA stating that,
you should just know, apparently.  But no good method emerged to let one
figure out what other programs may do the same thing and also need to be
recompiled.

Hence the discussion yesterday in this thread.  Jeremy Huddleston
suggested doing "readelf -s <exec> | grep <symbol>".  I'm no guru, and
don't totally understand what a file containing any given symbol means,
but if this command does indeed show if a file was statically compiled
against a given library, then there are a lot of things that need to be
recompiled.  Put it in a little script and run it against my /usr/bin/
shows such files as ftp, links2, mutt, ssh, and wget.  That doesn't
sound right to me, but... how can I prove it one way or the other?

Marc's grep command above returns nothing compiled with the static USE
flag.

IMHO, in source-based distribution this is a critical issue and needs to
be solved.  I wish I knew what that solution was :(

-Joel Osburn


--
gentoo-security@g.o mailing list