RE: [gentoo-security] Do I need to rebuild things after upgradingssl?

[Joel Osburn]

> -----Original Message-----
> From: Simon Reynolds [mailto:sproket@××××××××.net]
> Sent: Friday, March 19, 2004 11:22 AM
> To: gentoo-security@l.g.o
> Subject: RE: [gentoo-security] Do I need to rebuild things
> after upgradingssl?

<snip>

>
> FYI: if the symbol appears in the ELF file, and it was dynamically
> linked to libssl, you probably don't need to worry about it.
>
> Keeping track of statically compiled dependencies through portage is a
> good idea, in the mean time here's a simple script to search your
> system:
> Warning! This takes a while to run, 15 min. on my system. It is not
> guaranteed to be exhaustive, and it may fry your hard drive. On my
> system, it returned three false positives.
>
>
> #!/bin/bash
>
> # I probably should have had this only check binaries coming from
> # packages which depend on ssl, but I wanted to be sure
>
> for d in /bin /lib /sbin /usr/bin /usr/lib /usr/libexec /usr/sbin \
> /usr/X11R6/bin /usr/X11R6/lib /usr/games/bin /usr/games/bin /opt
> do
>     for i in `find $d -type f -perm +0111`
>     do
>         file $i | grep ELF >/dev/null || continue
>         ldd $i | grep libssl >/dev/null && continue
>         readelf -s $i | grep " SSL_" >/dev/null || continue
>         echo $i
>     done
> done
>


Adding the ldd test to my test script (which follows the same logic as
Simon's)and running it on /usr/bin yields ssh as a guilty party.  Can
this be so?  Running "ldd ssh" yields:

        libutil.so.1 => /lib/libutil.so.1 (0x40019000)
        libz.so.1 => /usr/lib/libz.so.1 (0x4001c000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x4002a000)
        libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x4003f000)
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x4013c000)
        libc.so.6 => /lib/libc.so.6 (0x40169000)
        libdl.so.2 => /lib/libdl.so.2 (0x40299000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

While "readelf -s ssh | grep -i ssl" results in:

    22: 0804a8d0   175 FUNC    GLOBAL DEFAULT  UND SSLeay_version
    56: 0804aaf0    37 FUNC    GLOBAL DEFAULT  UND
OPENSSL_add_all_algorithm
    83: 0804ac90    10 FUNC    GLOBAL DEFAULT  UND SSLeay

So does openssh need to be recompiled whenever one recompiles openssl,
or is there another explanation?

-Joel Osburn


--
gentoo-security@g.o mailing list