oss-security - CVE# request: pigz creates temp file with insecure permissions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 15 Feb 2013 12:33:30 +0400
From: Michael Tokarev <mjt@....msk.ru>
To: oss-security@...ts.openwall.com
Subject: CVE# request: pigz creates temp file with insecure permissions

I think this one well deserves a CVE#.  I just submitted the following
bug #700608 to Debian BTS:

When asked to compress a file with restricted permissions (like
mode 0600), the .gz file pigz creates while doing this has
usual mode derived from umask (like 0644).  If the file is
large enough (and why we would use pigz instead of gzip for
small files), this results in the original content being
readable for everyone until the compression finishes.

Here's the deal:

$ fallocate -l 1G foo
$ chmod 0600 foo
$ pigz foo &
$ ls -l foo foo.gz
-rw------- 1 mjt mjt 1073741824 Feb 15 12:27 foo
-rw-rw-r-- 1 mjt mjt     502516 Feb 15 12:27 foo.gz

When it finishes, it correctly applies original file permissions
to the newly created file, but it is already waaay too late.

Other one-file archivers (gzip, xz, bzip2, ...) usually create
the temp file with very strict permissions first, and change it
to the right perms only when done, so only the current user can
read it.

Thanks!

/mjt

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.