oss-security - xfe: directory masks ignored when creating new files on Samba and NFS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 24 Feb 2014 16:41:15 +1100
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
CC: 739536@...s.debian.org
Subject: xfe: directory masks ignored when creating new files on Samba and
 NFS

Hello,

Robert Rottscholl reported that when creating a new file via X File 
Explorer (xfe) on a Samba or NFS share, the user's mask was used for the 
permissions instead of that specified by the Samba or NFS configuration. 
Full details and patches are available from the following:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739536

 From brief testing on Fedora with Samba and the "create mask" smb.conf 
option, this issue only presented when running xfe as the root user. The 
intended mask was used when running xfe as an unprivileged user. I don't 
the equivalent NFS option.

Can a CVE please be assigned if one has not been already?

Thanks,

--
Murray McAllister / Red Hat Security Response Team

https://bugzilla.redhat.com/show_bug.cgi?id=1069066

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.