Date: Fri, 15 Feb 2013 12:33:30 +0400 From: Michael Tokarev <mjt@....msk.ru> To: oss-security@...ts.openwall.com Subject: CVE# request: pigz creates temp file with insecure permissions I think this one well deserves a CVE#. I just submitted the following bug #700608 to Debian BTS: When asked to compress a file with restricted permissions (like mode 0600), the .gz file pigz creates while doing this has usual mode derived from umask (like 0644). If the file is large enough (and why we would use pigz instead of gzip for small files), this results in the original content being readable for everyone until the compression finishes. Here's the deal: $ fallocate -l 1G foo $ chmod 0600 foo $ pigz foo & $ ls -l foo foo.gz -rw------- 1 mjt mjt 1073741824 Feb 15 12:27 foo -rw-rw-r-- 1 mjt mjt 502516 Feb 15 12:27 foo.gz When it finishes, it correctly applies original file permissions to the newly created file, but it is already waaay too late. Other one-file archivers (gzip, xz, bzip2, ...) usually create the temp file with very strict permissions first, and change it to the right perms only when done, so only the current user can read it. Thanks! /mjt
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.