Bugtraq mailing list archives
Zip 2,31 bad default file-permissions vulnerability
From: Imran Ghory <imranghory () gmail com>
Date: Tue, 2 Aug 2005 23:22:54 +0100
================================ Zip bad default file-permissions vulnerability ================================ Software: Zip Version: 2.31 Software URL: <http://www.info-zip.org/Zip.html> Platform: Unix, Linux. Vulnerability type: File permission, privacy. Severity: Medium. Allows local user to read files belonging to the gzip user which they couldn't otherwisre. Vulnerable software ==================== Zip 2.31 and previous versions running on unix. Vulnerability ============== A zip file created by Zip 2.3.1 has the permissions 644 by default, Therefore any file compressed becomes world readable. Particularly at risk are backup systems which zip password files, databases and other confidential files which are only meant to be readable by a single user or group. Workaround ======== None at the moment, It should be straightforward to fix in the source by setting the umask correctly. -- Imran Ghory
Current thread:
- Zip 2,31 bad default file-permissions vulnerability Imran Ghory (Aug 03)
- Re: Zip 2,31 bad default file-permissions vulnerability Lupe Christoph (Aug 04)
- Re: Zip 2,31 bad default file-permissions vulnerability Imran Ghory (Aug 04)
- Re: Zip 2,31 bad default file-permissions vulnerability Lupe Christoph (Aug 04)
- Re: Zip 2,31 bad default file-permissions vulnerability Stephen C Woods (Aug 05)
- Re: Zip 2,31 bad default file-permissions vulnerability Lupe Christoph (Aug 05)
- Message not available
- Re: Zip 2,31 bad default file-permissions vulnerability Imran Ghory (Aug 09)
- Re: Zip 2,31 bad default file-permissions vulnerability Imran Ghory (Aug 04)
- Re: Zip 2,31 bad default file-permissions vulnerability Lupe Christoph (Aug 04)