REDHAT-BUG-598775: Medium severity RPM RPM vulnerability

Created attachment 418879 [details] SRPM for testing this bug

Description of problem: When RPM replaces an executable, it does not clear the setuid and setgid bits of the old file. Thus, if a user made a hard link to the old executable, he/she will still be able to run it with elevated privileges. This is bad if it was replaced because it had a vulnerability. The problem seems to occur only when executables are replaced, not when they are erased.

This is the same bug that was previously noted in dpkg: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=225692

Version-Release number of selected component (if applicable): rpm-4.8.0-14.fc13.x8664

How reproducible: Always

Steps to Reproduce: 1. Rebuild the attached SRPM twice, once with -D 'rel 1' and once with -D 'rel 2'. 2. mkdir /tmp/rpm-setuid-test 3. rpm -i rpm-setuid-test-0-1.fc13.$(rpm -E '%{buildarch}').rpm 4. ln /usr/bin/rpm-setuid-test /tmp/rpm-setuid-test/ 5. rpm -U rpm-setuid-test-0-2.fc13.$(rpm -E '%{buildarch}').rpm 6. ls -l /tmp/rpm-setuid-test/rpm-setuid-test

Actual results: The old executable is setuid.

Expected results: The old executable is not setuid.