Bug 118314 – net-analyzer/net-snmp: 5.2.2 insecure Runpath in perl bindings

• Status: RESOLVED INVALID
• Product: Gentoo Security

[Description Santiago Gala 2006-01-08 11:34:51 UTC]

(...)


QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/default_store/../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/default_store/default_store.so
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/ASN/../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/ASN/ASN.so
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/OID/../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/OID/OID.so
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/agent/../../agent/.libs:/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/agent/../../agent/helpers/.libs:/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/agent/../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/agent/agent.so
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/agent/default_store/../../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/agent/default_store/default_store.so
/var/tmp/portage/net-snmp-5.2.2/work/net-snmp-5.2.2/perl/SNMP/../../snmplib/.libs:/usr/lib usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/SNMP/SNMP.so


QA Notice: the following files contain executable stacks
 Files with executable stacks will not work properly (or at all!)
 on some architectures/operating systems.  A bug should be filed
 at http://bugs.gentoo.org/ to make sure the file is fixed.
--- --- RWX usr/lib/libnetsnmp.so.9.0.0
--- --- RWX usr/lib/libsnmp.so.9.0.0
--- --- RWX usr/lib/libnetsnmpmibs.so.9.0.0
--- --- RWX usr/lib/libnetsnmpagent.so.9.0.0
--- --- RWX usr/lib/libnetsnmphelpers.so.9.0.0
--- --- RWX usr/lib/libnetsnmptrapd.so.9.0.0
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/default_store/default_store.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/ASN/ASN.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/OID/OID.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/agent/agent.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/agent/default_store/default_store.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/NetSNMP/TrapReceiver/TrapReceiver.so
--- --- RWX usr/lib/perl5/site_perl/5.8.7/powerpc-linux/auto/SNMP/SNMP.so
--- --- RWX usr/bin/snmpget
--- --- RWX usr/bin/snmpgetnext
--- --- RWX usr/bin/snmpset
--- --- RWX usr/bin/snmpusm
--- --- RWX usr/bin/snmpwalk
--- --- RWX usr/bin/snmpbulkwalk
--- --- RWX usr/bin/snmptable
--- --- RWX usr/bin/snmptrap
--- --- RWX usr/bin/snmpbulkget
--- --- RWX usr/bin/snmptranslate
--- --- RWX usr/bin/snmpstatus
--- --- RWX usr/bin/snmpdelta
--- --- RWX usr/bin/snmptest
--- --- RWX usr/bin/encode_keychange
--- --- RWX usr/bin/snmpdf
--- --- RWX usr/bin/snmpvacm
--- --- RWX usr/bin/snmpnetstat53
--- --- RWX usr/sbin/snmpd
--- --- RWX usr/sbin/snmptrapd


!!! ERROR: net-analyzer/net-snmp-5.2.2 failed.
!!! Function dyn_install, Line 1094, Exitcode 0
!!! Aborting due to serious QA concerns with RUNPATH/RPATH
!!! If you need support, post the topmost build error, NOT this status message.

[Comment 1 Stefan Cornelius (RETIRED) 2006-01-08 11:43:50 UTC]

netmon please provide a fixed package, thanks.

[Comment 2 Stefan Cornelius (RETIRED) 2006-01-08 13:12:35 UTC]

Santiago Gala, what exactly is your perl version? Did you clean up the perl installs using app-admin/perl-cleaner after emerging the last update? If not, please do so and retry to emerge net-snmp. Thanks.

[Comment 3 Santiago Gala 2006-01-08 17:49:06 UTC]

perl version: dev-lang/perl-5.8.7-r3 (ppc stable)
app-admin/perl-cleaner-1.01 reported nothing to do after a long while

tried to emerge again, same error

[Comment 4 Thierry Carrez (RETIRED) 2006-01-13 06:56:03 UTC]

Reclassifying

[Comment 5 Thierry Carrez (RETIRED) 2006-01-15 09:33:18 UTC]

Also please check you don't have ExtUtils-MakeMaker installed. If you do, unmerge it and try again to install net-snmp...

[Comment 6 Steven James 2006-01-30 09:29:28 UTC]

I had this same problem but after running 'perl-cleaner all' it cleared up. Any way we can add perl-cleaner to the end of the perl build automatically?

[Comment 7 Marcelo Goes (RETIRED) 2006-01-30 14:56:21 UTC]

I do not think perl guys like this idea, or it would already be done.

[Comment 8 Jakub Moc (RETIRED) 2006-03-05 04:54:18 UTC]

*** Bug 125070 has been marked as a duplicate of this bug. ***