Bug 1305581

present on RHEL-6.7 too

+++ This bug was initially created as a clone of Bug #1250015 +++

Description of problem:

While trying to reproduce the problem described in bug 1206312 I have also used specially crafted ELF created using the script from http://mx.gw.com/pipermail/file/2014/001653.html
Since it doesn't contain debug info it is processed differently as the real ELF but I have encountered one thing. When building the SPEC after removing the '%debug_package' macro I can see various error messages in the build log. It looks as follows:

Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.YOp1bI
+ umask 022
+ cd /root/rpmbuild/BUILD
+ exit 0
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.Dsru9n
+ umask 022
+ cd /root/rpmbuild/BUILD
+ '[' /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 '!=' / ']'
+ rm -rf /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
++ dirname /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
+ mkdir -p /root/rpmbuild/BUILDROOT
+ mkdir /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
+ mkdir -p /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin
+ cp /mnt/testarea/test/bz1206312_crafted_elf.so /mnt/testarea/test/bz1206312_real.so.debug /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin
+ chmod a+x /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_crafted_elf.so /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_real.so.debug
+ /usr/lib/rpm/check-buildroot
+ /usr/lib/rpm/redhat/brp-compress
+ /usr/lib/rpm/redhat/brp-strip /usr/bin/strip
+ /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
/usr/bin/objdump: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file
/usr/bin/strip: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file
/usr/bin/objdump: 'too': No such file
/usr/bin/strip: 'too': No such file
/usr/bin/objdump: 'many': No such file
/usr/bin/strip: 'many': No such file
/usr/bin/objdump: 'notes': No such file
/usr/bin/strip: 'notes': No such file
/usr/bin/objdump: '(256)': No such file
/usr/bin/strip: '(256)': No such file

Seems that also /usr/lib/rpm/brp-strip-comment-note should be fixed.

Patch similar to 
https://github.com/rpm-software-management/rpm/commit/5b4805df2085b0e7c4f09caad62638c3238b3bc1
should be applied also for redhat-rpm-config

Setting severity to Low since the fix for CVE-2014-9620 is not present in RHEL-6 nor RHEL-7 (intentionally) and therefore I was only able to reproduce it using the file from Fedora 21.