Re: Zip 2,31 bad default file-permissions vulnerability
On 8/4/05, Lupe Christoph <lupe@xxxxxxxxxxxxxxxxx> wrote:
> Quoting Imran Ghory <imranghory@xxxxxxxxx>:
>
> > A zip file created by Zip 2.3.1 has the permissions 644 by default,
> > Therefore any file compressed becomes world readable.
>
> Zip 2.3 works correctly:
> $ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
> adding: feedlist.opml (deflated 80%)
> -rw-rw-rw- 1 lupe lupe 3156 Aug 4 10:52 test.zip
A clarification: Zip obeys the umask, the example I gave was due to
most unix distributions having a default umask which makes new files
world readable. Contrast this with gzip/bzip2 which will ignore the
umask and preserve the permissions of the file being compressed.
Imran Ghory