Re: Zip 2,31 bad default file-permissions vulnerability
One can make a very convincing for umask -the actual definition is
real permission = (~umask & file-permissions), it's easy enough to
modify your .profile/.login/.cshrc to add a line umask 77.
The problem is the zip uses a default mode of 666 (not knowing
anything about permissions by definition -it's a DOS program for Pete's
sake, you know single user file server).
<scw>
On Thu, Aug 04, 2005 at 01:01:23PM +0100, Imran Ghory wrote:
> On 8/4/05, Lupe Christoph <lupe@xxxxxxxxxxxxxxxxx> wrote:
> > Quoting Imran Ghory <imranghory@xxxxxxxxx>:
> >
> > > A zip file created by Zip 2.3.1 has the permissions 644 by default,
> > > Therefore any file compressed becomes world readable.
> >
> > Zip 2.3 works correctly:
> > $ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
> > adding: feedlist.opml (deflated 80%)
> > -rw-rw-rw- 1 lupe lupe 3156 Aug 4 10:52 test.zip
>
> A clarification: Zip obeys the umask, the example I gave was due to
> most unix distributions having a default umask which makes new files
> world readable. Contrast this with gzip/bzip2 which will ignore the
> umask and preserve the permissions of the file being compressed.
>
> Imran Ghory
>
--
-----
Stephen C. Woods; UCLA SEASnet; 2567 Boelter hall; LA CA 90095; (310)-825-8614
Unless otherwise noted these statements are my own, Not those of the
University of California. Internet mail:scw@xxxxxxxxxxxxx