Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Sep 2012 06:35:49 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
CC: Matthias Weckbecker <mweckbecker@...e.de>, vcizek@...e.de, 
 tmraz@...hat.com
Subject: Re: CVE request(?): gpg: improper file permssions
 set when en/de-crypting files

On 09/21/2012 06:20 AM, Matthias Weckbecker wrote:
> Hello Steve, Kurt, Vitezslav, Tomas, vendors,
>
> we have recently been notified about a potential issue with gpg: When files
> are en/de-crypted the result is written world-readable by default.
> Short example (quote from [1]):
>
>  # de-crypting
>  % gpg sikrit.gpg
>  % ll sikrit*
>    -rw-r--r-- 1 gp users  12 Sep 17 09:41 sikrit
>    -rw------- 1 gp users 480 Sep 17 09:40 sikrit.gpg
>  # en-crypting
>  % echo "my password" > sikrit
>  % chmod go= sikrit
>  % ll sikrit
>    -rw------- 1 gp users 12 Sep 17 09:38 sikrit
>  % gpg -e -r pfeifer sikrit
>  % wipe sikrit
>  % ll sikrit.gpg 
>    -rw-r--r-- 1 gp users 480 Sep 17 09:40 sikrit.gpg
>
> [1] https://bugzilla.novell.com/show_bug.cgi?id=780943
>
> Wouldn't one usually expect files that were previously encrypted to contain
> sensitive content (that's probably why content is encrypted at all)? And if
> so, shouldn't such files be only readable by certain users / group of users
> by default? Otherwise, a file that is e.g. decrypted in /tmp might leak due
> to the file permissions being too loose.

GPG seems to just be honoring the umask:

$ ll secret
-rw------- 1 dan dan 9 Sep 21 06:31 secret
$ umask 0777
$ gpg -e -r dan secret
$ ll secret.gpg
---------- 1 dan dan 605 Sep 21 06:34 secret.gpg

Still might be worth fixing though.

-Dan

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.