bugtraq - Re: Zip 2,31 bad default file-permissions vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1123145635.42f1d7a31db4a@buexe.b-5.de>
Date: Thu,  4 Aug 2005 10:53:55 +0200
From: Lupe Christoph <lupe@...e-christoph.de>
To: Imran Ghory <imranghory@...il.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Zip 2,31 bad default file-permissions vulnerability


Quoting Imran Ghory <imranghory@...il.com>:

> A zip file created by Zip 2.3.1 has the permissions 644 by default,
> Therefore any file compressed becomes world readable.

Zip 2.3 works correctly:
$ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
  adding: feedlist.opml (deflated 80%)
-rw-rw-rw-    1 lupe     lupe         3156 Aug  4 10:52 test.zip
$ (umask 077; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
  adding: feedlist.opml (deflated 80%)
-rw-------    1 lupe     lupe         3156 Aug  4 10:52 test.zip

HTH,
Lupe Christoph
-- 
| lupe@...e-christoph.de       |           http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like   |
| covering yourself with barbecue sauce and breaking into the Charity    |
| Home for Badgers with Rabies.                            Michael Lucas |