Bug#837548: lintian: Should warn about PE/Windows binaries lacking security features

[Petter Reinholdtsen]

Package: lintian
Version: 2.5.46
Severity: wishlist

There are some Windows binaries in Debian. For example the installer
ISOs include a Windows installer, but also other packages include these
PE binaries. And these days, Windows binaries should have security
features enabled by default. But not all of them do, and I believe
lintian should detect and warn if we discribute PE binaries without
these features enabled.

Here is an example using a 15 year old binary I had lying around:

% file WirelessCom2.exe
WirelessCom2.exe: PE32 executable (console) Intel 80386, for MS Windows
% pesec WirelessCom2.exe
ASLR: no
DEP/NX: no
SEH: yes
Stack cookies (EXPERIMENTAL): yes
%

Both ASLR and DEP/NX should be enabled in a properly compiled Windows
binary.

The mingw compiler in Debian recently changed its default settings to
enable these (see <URL: https://bugs.debian.org/836365 >), and now I
believe we should add a lintian check to track down all packages in need
of a rebuild.

I'll try to find time to write such lintian check myself, and create
this bug report to make others aware of the idea and to reduce the
chance of duplicate efforts if others are considering the same.

[Petter Reinholdtsen]

I had a look at this, but am unsure where in the lintian code it is best
to implement such change. It would be useful with some input from the
Lintian developers on this. The issue is still relevant, even though
the latest ming compiler changed its default, making rebuilds solve the
issue. Here is the state from a rebuilt gzip-win32 and the version in
the archive:

% pesec gzip-1.6/debian/gzip-win32/usr/share/win32/gzip.exe
ASLR: yes
DEP/NX: yes
SEH: yes
Stack cookies (EXPERIMENTAL): yes
% pesec /usr/share/win32/gzip.exe
ASLR: no
DEP/NX: no
SEH: yes
Stack cookies (EXPERIMENTAL): yes
% file --mime-type /usr/share/win32/gzip.exe
/usr/share/win32/gzip.exe: application/x-dosexec
% file /usr/share/win32/gzip.exe
/usr/share/win32/gzip.exe: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
%

The lintian check should run pesec on all Windows binaries and warn if
any of the security features are turned off.