oss-sec mailing list archives
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files
From: Michael Gilbert <mgilbert () debian org>
Date: Fri, 21 Sep 2012 14:27:43 -0400
On Fri, Sep 21, 2012 at 2:18 PM, Kurt Seifried <kseifried () redhat com> wrote:
Any security weakness can qualify for the E in CVE. Really the pointNo, security vulnerabilities qualify, security hardening does not necessarily qualify.
Again E is for exposure, not vulnerability.
In this case GnuPG respects umask. We can't assign a CVE for every single program that has potentially sensitive output and fails to ensure that the output is mode 0600 or whatever (what about extended access controls?). Some programs choose to enforce permissions within themselves (e.g. OpenSSH and key based authentication), but generally speaking makeing sure a program with potentially sensitive output is safe is the job of the system configuration, and you have several options:
Think about it this way. I open a file with mode 600 in vim, edit it, save it, and find it with mode 644? That would be an exposure, would it not? Again, about as minor as you could get, but its still an E. Best wishes, Mike
Current thread:
- CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Dan Rosenberg (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tomas Mraz (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Kurt Seifried (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Kurt Seifried (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 24)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Dan Rosenberg (Sep 21)