Bug 123815

Summary:	mjpegtools-1.8.0-r1 insecure RUNPATH's
Product:	Gentoo Security	Reporter:	dean mikel <dean>
Component:	Runpath Issues	Assignee:	Gentoo Security <security>
Status:	RESOLVED NEEDINFO
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	x86
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description dean mikel 2006-02-23 06:27:23 UTC

I have seen this error reported for many different libraries recently, but have not seen mjpegtools listed, so I'm entering a new bug.

It was working correctly until I recently performed a emerge --sync and emerge -uD world. Now I get this error when emerging mjpegtools:

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/lib/libmpeg2encpp-1.8.so.0.0.0
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/lib/libmplex2-1.8.so.0.0.0
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/mpeg2enc
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/mjpeg_simd_helper
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lav2wav
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lav2yuv
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvmedianfilter
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavaddwav
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavtrans
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/ypipe
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuv2lav
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/transist.flt
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/matteblend.flt
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/multiblend.flt
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavpipe
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvscaler
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvcorrect
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvcorrect_tune
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/jpeg2yuv
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/ppmtoy4m
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/pnmtoy4m
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mtoppm
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mtopnm
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/pgmtoy4m
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mcolorbars
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavinfo
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mshift
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mspatialfilter
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mstabilizer
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvfps
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mhist
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mblack
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mtoyuv
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4minterlace
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuv4mpeg
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuyvtoy4m
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvinactive
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/glav
/usr/lib:/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvplay
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavrec
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/testrec
/usr/lib:/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/lavplay
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/png2yuv
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/mp2enc
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/mplex
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvdenoise
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvycsnoise
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvkineco
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/yuvdeinterlace
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4mdenoise
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib usr/bin/y4munsharp


!!! ERROR: media-video/mjpegtools-1.8.0-r1 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
!!! Insecure binaries detected
!!! If you need support, post the topmost build error, NOT this status message.


emerge info:
Portage 2.0.54 (default-linux/x86/2005.1, gcc-3.3.6, glibc-2.3.5-r2, 2.6.12-gentoo-r6 i686)
=================================================================
System uname: 2.6.12-gentoo-r6 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.14
dev-lang/python:     2.3.5, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=athlon-xp -pipe -O2"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-march=athlon-xp -pipe -O2"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apm arts audiofile avi berkdb bitmap-fonts bzip2 cdr crypt cups curl dv dvd dvdr eds emboss encode esd exif expat fam ffmpeg flac foomaticdb fortran gdbm gif gpm gstreamer hal idn imagemagick imlib ipv6 jack java jpeg kde lcms libg++ libwww mad mikmod mng motif mp3 mpeg ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl png python qt quicktime readline sdl spell ssl tcltk tcpd tiff truetype truetype-fonts type1-fonts udev usb vorbis win32codecs xml2 xmms xv xvid zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY

Comment 1 dean mikel 2006-02-23 07:10:14 UTC

I also tried emerging mjpegtools-1.6.2-r4 to see if it was a version specific problem, which ended up with the same results.

I then downloaded the source for mjpegtools 1.8.0, compiled and installed  without any problem. However since it was not emerged, other dependent packages (cinelerra) still try to emerge mjpegtools which fails with the same error.

Comment 2 SpanKY gentoo-dev

2006-02-23 17:30:00 UTC

run `MAKEOPTS=-j1 emerge mjpegtools >& log` and post the log as an attachment

Comment 3 SpanKY gentoo-dev

2006-03-05 19:47:34 UTC

get back to us please after you run this:
MAKEOPTS="-j1" MAKEFLAGS="--debug=b" emerge mjpegtools >& log