Hide Forgot
present on RHEL-6.7 too +++ This bug was initially created as a clone of Bug #1250015 +++ Description of problem: While trying to reproduce the problem described in bug 1206312 I have also used specially crafted ELF created using the script from http://mx.gw.com/pipermail/file/2014/001653.html Since it doesn't contain debug info it is processed differently as the real ELF but I have encountered one thing. When building the SPEC after removing the '%debug_package' macro I can see various error messages in the build log. It looks as follows: Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.YOp1bI + umask 022 + cd /root/rpmbuild/BUILD + exit 0 Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.Dsru9n + umask 022 + cd /root/rpmbuild/BUILD + '[' /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 '!=' / ']' + rm -rf /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 ++ dirname /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 + mkdir -p /root/rpmbuild/BUILDROOT + mkdir /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 + mkdir -p /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin + cp /mnt/testarea/test/bz1206312_crafted_elf.so /mnt/testarea/test/bz1206312_real.so.debug /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin + chmod a+x /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_crafted_elf.so /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_real.so.debug + /usr/lib/rpm/check-buildroot + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump /usr/bin/objdump: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file /usr/bin/strip: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file /usr/bin/objdump: 'too': No such file /usr/bin/strip: 'too': No such file /usr/bin/objdump: 'many': No such file /usr/bin/strip: 'many': No such file /usr/bin/objdump: 'notes': No such file /usr/bin/strip: 'notes': No such file /usr/bin/objdump: '(256)': No such file /usr/bin/strip: '(256)': No such file Seems that also /usr/lib/rpm/brp-strip-comment-note should be fixed. Patch similar to https://github.com/rpm-software-management/rpm/commit/5b4805df2085b0e7c4f09caad62638c3238b3bc1 should be applied also for redhat-rpm-config Setting severity to Low since the fix for CVE-2014-9620 is not present in RHEL-6 nor RHEL-7 (intentionally) and therefore I was only able to reproduce it using the file from Fedora 21.
*** This bug has been marked as a duplicate of bug 1321988 ***