Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 156989

Summary: app-antivirus/vlnx-4510e: invalid usage of RESTRICT=binchecks CVE-2006-6474
Product: Gentoo Security Reporter: Jakub Moc (RETIRED) <jakub>
Component: Runpath IssuesAssignee: Gentoo Security <security>
Severity: enhancement CC: drizzt, qa
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: [B1? maskglsa]
Package list:
Runtime testing required: ---

Description Jakub Moc (RETIRED) gentoo-dev 2006-12-03 07:42:30 UTC
This feature is NOT meant for hiding those scanelf QA warnings; that's what
QA_{TEXTRELS,EXECSTACK,WX_LOAD} is for when the package can't be fixed. 

RESTRICT="binchecks" should _only_ be used for stuff where these checks don't
make any sense and just cause needless overhead (pure data stuff, like kernel
sources, icon packs, themes, fonts etc.)
Comment 1 Timothy Redaelli (RETIRED) gentoo-dev 2006-12-09 07:04:47 UTC
last rites
# Timothy Redaelli <> (09 Dec 2006)
# pending removal (#156989)
# can't fix rpath, application checks its checksum

i close the bug when i'll punt the package
Comment 2 Tavis Ormandy (RETIRED) gentoo-dev 2006-12-11 10:01:00 UTC
Thanks for finding this bug Jakub, this is a security issue and we need to vote on a maskglsa.

I tend to vote YES as scanning a file with a specific name may result in arbitrary code execution.

Timothy: please dont disable these checks in future without checking with the security team (ideally me or solar)!
Comment 3 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-12-11 10:10:43 UTC
I vote YES.
Comment 4 Wolf Giesen (RETIRED) gentoo-dev 2006-12-11 10:38:24 UTC
Comment 5 solar (RETIRED) gentoo-dev 2006-12-11 11:27:56 UTC
YES Vote. Solution in the GLSA should suggest removal from the system.
Comment 6 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-12-13 22:31:05 UTC
GLSA 200612-15
Comment 7 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-12-14 06:03:05 UTC
severity -> enhancement for (maybe?) later resolution
Comment 8 Jakub Moc (RETIRED) gentoo-dev 2007-03-02 17:22:28 UTC
Removed from the tree.