>Number:         2682
>Category:       bin
>Synopsis:       setuid dynamic objects ignore compiled-in library paths
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug  9 20:50:01 1996
>Last-Modified:
>Originator:     Michael Graff
>Organization:
flame.org:  yes, we do know everything
>Release:        08-Aug-1996
>Environment:
	
System: NetBSD kechara.flame.org 1.2A NetBSD 1.2A (ZHANEEL) #4: Mon Jul 29 16:51:24 EDT 1996 explorer@kechara.flame.org:/u1/netbsd/src/sys/arch/i386/compile/ZHANEEL i386


>Description:
When a program is compiled and the location of shared libraries are
specified on the link line, if the program is setuid these compiled-in
search paths are excluded from search.

Since the executable has this search path compiled in, it seems to be ok
to allow it to be searched since, if the user can modify this path or the
contents in the directory, the system is already in trouble.

>How-To-Repeat:
Compile a program which uses a private shared library in /tmp with:

	cc -Wl,R -Wl/tmp foo.c

Make the file setuid some other user, and the library cannot be found.
>Fix:
	
>Audit-Trail:
>Unformatted: