[Bug 768713] [NEW] amavisd-milter is no longer built w/PIE and BINDNOW hardening

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Steve Beattie (sbeattie):

Binary package hint: amavisd-milter

In maverick and and earlier, amavisd-new-milter was built with the PIE
and BINDNOW hardening options (see
https://wiki.ubuntu.com/Security/HardeningWrapper and
http://wiki.debian.org/Hardening). With the replacement of amavisd-new-
milter by amavisd-milter, this hardening protection is gone.

To reproduce:
1) grab the hardening_check script from http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/view/head:/scripts/built-binaries/hardening-check
2) unpack via dpkg-deb -x or install amavsid-milter
3) run the hardening-check script on (EXTRACTEDPATH)/usr/sbin/amavisd-milter
4) output should look like:
  /usr/sbin/amavisd-milter:
  Position Independent Executable: yes
  Stack protected: yes
  Fortify Source functions: yes
  Read-only relocations: yes
  Immediate binding: yes
however, without hardening-wrapper applied, it looks like:
  /usr/sbin/amavisd-milter:
  Position Independent Executable: no, normal executable!
  Stack protected: yes
  Fortify Source functions: yes
  Read-only relocations: yes
  Immediate binding: no, not found!

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: amavisd-milter 1.5.0-2
ProcVersionSignature: Ubuntu 2.6.38-8.42-server 2.6.38.2
Uname: Linux 2.6.38-8-server x86_64
Architecture: amd64
Date: Thu Apr 21 17:48:50 2011
InstallationMedia: Ubuntu-Server 11.04 "Natty Narwhal" - Alpha amd64 (20110211)
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: amavisd-milter
UpgradeStatus: No upgrade log present (probably fresh install)

** Affects: amavisd-milter (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: amd64 apport-bug natty
-- 
amavisd-milter is no longer built w/PIE and BINDNOW hardening
https://bugs.launchpad.net/bugs/768713
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is a direct subscriber.