I discovered this attack over a year ago, so let me fill you in.
At that time the a.out ld.so was not vulnerable but ELF ld.so
definately was. Trigging the overflow required a resource starvation
attack on fd's, which was easily performed by setting system resource
consumption limits for file descriptors to an appropriately low value.
FreeBSD was not vulnerable to any ld.so attacks that I could
observe.
--
Prof. Julian Assange |If you want to build a ship, don't drum up people
|together to collect wood and don't assign them tasks
proff@iq.org |and work, but rather teach them to long for the endless
proff@gnu.ai.mit.edu |immensity of the sea. -- Antoine de Saint Exupery