bugtraq - Re: Zip 2,31 bad default file-permissions vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 4 Aug 2005 13:01:23 +0100
From: Imran Ghory <imranghory@...il.com>
To: Lupe Christoph <lupe@...e-christoph.de>,
	bugtraq@...urityfocus.com
Subject: Re: Zip 2,31 bad default file-permissions vulnerability


On 8/4/05, Lupe Christoph <lupe@...e-christoph.de> wrote:
> Quoting Imran Ghory <imranghory@...il.com>:
> 
> > A zip file created by Zip 2.3.1 has the permissions 644 by default,
> > Therefore any file compressed becomes world readable.
> 
> Zip 2.3 works correctly:
> $ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
>  adding: feedlist.opml (deflated 80%)
> -rw-rw-rw-    1 lupe     lupe         3156 Aug  4 10:52 test.zip

A clarification: Zip obeys the umask, the example I gave was due to
most unix distributions having a default umask which makes new files
world readable. Contrast this with gzip/bzip2 which will ignore the
umask and preserve the permissions of the file being compressed.

Imran Ghory