bugtraq - Re: Zip 2,31 bad default file-permissions vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050804221735.GB15127@seas.ucla.edu>
Date: Thu, 4 Aug 2005 15:17:35 -0700
From: Stephen C Woods <scw@...s.ucla.edu>
To: Imran Ghory <imranghory@...il.com>
Cc: Lupe Christoph <lupe@...e-christoph.de>,
	bugtraq@...urityfocus.com
Subject: Re: Zip 2,31 bad default file-permissions vulnerability


  One can make a very convincing for umask -the actual definition is
  real permission = (~umask & file-permissions), it's easy enough to
modify your .profile/.login/.cshrc to add a line umask 77.

  The problem is the zip uses a default mode of 666 (not knowing
anything about permissions by definition -it's a DOS program for Pete's
sake, you know single user file server).

<scw>

On Thu, Aug 04, 2005 at 01:01:23PM +0100, Imran Ghory wrote:
> On 8/4/05, Lupe Christoph <lupe@...e-christoph.de> wrote:
> > Quoting Imran Ghory <imranghory@...il.com>:
> > 
> > > A zip file created by Zip 2.3.1 has the permissions 644 by default,
> > > Therefore any file compressed becomes world readable.
> > 
> > Zip 2.3 works correctly:
> > $ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
> >  adding: feedlist.opml (deflated 80%)
> > -rw-rw-rw-    1 lupe     lupe         3156 Aug  4 10:52 test.zip
> 
> A clarification: Zip obeys the umask, the example I gave was due to
> most unix distributions having a default umask which makes new files
> world readable. Contrast this with gzip/bzip2 which will ignore the
> umask and preserve the permissions of the file being compressed.
> 
> Imran Ghory
> 

-- 
-----
Stephen C. Woods; UCLA SEASnet; 2567 Boelter hall; LA CA 90095; (310)-825-8614
Unless otherwise noted these statements are my own, Not those of the 
University of California.                      Internet mail:scw@...s.ucla.edu