Bug 1305581 - /usr/lib/rpm/redhat/brp-strip-comment-note fails on file input
Summary: /usr/lib/rpm/redhat/brp-strip-comment-note fails on file input
Keywords:
Status: CLOSED DUPLICATE of bug 1321988
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: redhat-rpm-config
Version: 6.7
Hardware: Unspecified
OS: Unspecified
medium
low
Target Milestone: rc
: ---
Assignee: Florian Festi
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-02-08 15:56 UTC by Karel Srot
Modified: 2016-03-30 06:19 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 1250015
Environment:
Last Closed: 2016-03-30 06:19:10 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Karel Srot 2016-02-08 15:56:46 UTC
present on RHEL-6.7 too

+++ This bug was initially created as a clone of Bug #1250015 +++

Description of problem:

While trying to reproduce the problem described in bug 1206312 I have also used specially crafted ELF created using the script from http://mx.gw.com/pipermail/file/2014/001653.html
Since it doesn't contain debug info it is processed differently as the real ELF but I have encountered one thing. When building the SPEC after removing the '%debug_package' macro I can see various error messages in the build log. It looks as follows:

Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.YOp1bI
+ umask 022
+ cd /root/rpmbuild/BUILD
+ exit 0
Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.Dsru9n
+ umask 022
+ cd /root/rpmbuild/BUILD
+ '[' /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64 '!=' / ']'
+ rm -rf /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
++ dirname /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
+ mkdir -p /root/rpmbuild/BUILDROOT
+ mkdir /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64
+ mkdir -p /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin
+ cp /mnt/testarea/test/bz1206312_crafted_elf.so /mnt/testarea/test/bz1206312_real.so.debug /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin
+ chmod a+x /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_crafted_elf.so /root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64//usr/sbin/bz1206312_real.so.debug
+ /usr/lib/rpm/check-buildroot
+ /usr/lib/rpm/redhat/brp-compress
+ /usr/lib/rpm/redhat/brp-strip /usr/bin/strip
+ /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump
/usr/bin/objdump: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file
/usr/bin/strip: '/root/rpmbuild/BUILDROOT/bz1206312pkg-1.0-1.x86_64/usr/sbin/bz1206312_crafted_elf.so,': No such file
/usr/bin/objdump: 'too': No such file
/usr/bin/strip: 'too': No such file
/usr/bin/objdump: 'many': No such file
/usr/bin/strip: 'many': No such file
/usr/bin/objdump: 'notes': No such file
/usr/bin/strip: 'notes': No such file
/usr/bin/objdump: '(256)': No such file
/usr/bin/strip: '(256)': No such file

Seems that also /usr/lib/rpm/brp-strip-comment-note should be fixed.

Patch similar to 
https://github.com/rpm-software-management/rpm/commit/5b4805df2085b0e7c4f09caad62638c3238b3bc1
should be applied also for redhat-rpm-config

Setting severity to Low since the fix for CVE-2014-9620 is not present in RHEL-6 nor RHEL-7 (intentionally) and therefore I was only able to reproduce it using the file from Fedora 21.

Comment 1 Karel Srot 2016-03-30 06:19:10 UTC

*** This bug has been marked as a duplicate of bug 1321988 ***


Note You need to log in before you can comment on or make changes to this bug.