Red Hat Bugzilla – Bug 973499
programs in par2cmdline package have an executable stack
Last modified: 2014-03-24 23:44:29 EDT
Description of problem: Many programs in par2cmdline package have an executable stack. "This makes it susceptible to stack based exploits should another weakness be found in the affected programs" (Steve Grubb). Version-Release number of selected component (if applicable): par2cmdline-0.4.tbb.20100203-11.fc18 How reproducible: You can use following programs to check if a package is hardened: http://people.redhat.com/sgrubb/files/rpm-chksec OR https://github.com/kholia/checksec Steps to Reproduce: Get scanner.py from https://github.com/kholia/checksec $ ./scanner.py par2cmdline-0.4.tbb.20100203-11.fc18.x86_64.rpm par2cmdline,par2cmdline-0.4.tbb.20100203-11.fc18.x86_64.rpm,/usr/bin/par2verify,mode=0100755,NX=Disabled,CANARY=Enabled,RELRO=Partial,PIE=Disabled,RPATH=Enabled,RUNPATH=Disabled,FORTIFY=Enabled,CATEGORY=None Notice "NX=Disabled" field.
Created attachment 759942 [details] this should get rid of executable stack
Created attachment 759943 [details] this should get rid of executable stack
Modified .spec file + a tiny patch to fix this problem are attached. par2cmdline-enable-NX.patch uses the same technique as used in the LAME package to fix the executable stack problem. After applying the patch, I have verified that the automated self-tests and manual tests pass.
Hi Erik, Is there any progress on this bug? Do the attached "patches" work?
Thank you very much for the patch! I'm going to push updated packages soon
par2cmdline-0.4.tbb.20100203-16.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/par2cmdline-0.4.tbb.20100203-16.fc19
Package par2cmdline-0.4.tbb.20100203-16.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing par2cmdline-0.4.tbb.20100203-16.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-11002/par2cmdline-0.4.tbb.20100203-16.fc19 then log in and leave karma (feedback).
par2cmdline-0.4.tbb.20100203-16.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.