Re: CVE# request: pigz creates temp file with insecure permissions

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/15/2013 01:33 AM, Michael Tokarev wrote:
> I think this one well deserves a CVE#.  I just submitted the
> following bug #700608 to Debian BTS:
>
> When asked to compress a file with restricted permissions (like 
> mode 0600), the .gz file pigz creates while doing this has usual
> mode derived from umask (like 0644).  If the file is large enough
> (and why we would use pigz instead of gzip for small files), this
> results in the original content being readable for everyone until
> the compression finishes.
>
> Here's the deal:
>
> $ fallocate -l 1G foo $ chmod 0600 foo $ pigz foo & $ ls -l foo
> foo.gz -rw------- 1 mjt mjt 1073741824 Feb 15 12:27 foo -rw-rw-r--
> 1 mjt mjt     502516 Feb 15 12:27 foo.gz
>
> When it finishes, it correctly applies original file permissions to
> the newly created file, but it is already waaay too late.
>
> Other one-file archivers (gzip, xz, bzip2, ...) usually create the
> temp file with very strict permissions first, and change it to the
> right perms only when done, so only the current user can read it.

Apologies for my first misreading of this. Please use CVE-2013-0296
for this issue.

> Thanks!
>
> /mjt


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRHyhPAAoJEBYNRVNeJnmT/58QANpX3fNSN/DV2k2h6/TMreid
gnqYXxndMTo6D63+4jWkKyMb+XsJjNJ52jvN3wAYwKGVk7MtrDzKydDFn5qFMBJ0
4Ysp+cVsD5HE4QRc6cJPkBNaoKA6t+cj0fInu/hqkXMTAZpUDEPn9p4FUjB0OSrJ
nOFz4PWbAPX8KItMNUmMCu/r2OnOQ7vhJDHk37GIXhEwvZE9Hf2m2mNtBfBHHrlw
7x8fO0lEmYi3aOhkvm+ka0U/YplmNWxWXjF0xoxzwQgEeJV+xSiCgk7Wk4YzYLTm
i4TPI/RHvvuXgKs2mzHXE6qu5F0ADif0Vhl2iEasl8X3Zjeb6nZ7i6r+eTAMmsXf
pJvDbC28PnPGSC+u9J4oibDbugu7FJXyYDWtDz6ylQTFDJZ6nXPKGfUUbq2i/7vn
G84r/1LsrF8PxBFu8fFCD/+tZtyoCMU8qosfiTFHi4sgVF/4jGBVmICkyn6IE+3e
VL/bcutjWd9gGg9S8MaAO+TDnEmaJbvluPlBandKNdZIV18e7bDed6fsGwXiyJ12
XGIC5A9IgxioG4yFguwB1LutVaBMW80UxjMZQDOoeTOLWLS6dLqFuLbWz3DK0b3a
aqh+tH1OvYNHgpu9UFDFFVvGCMziXL8k95dPb/8BbHF0YB4GGP9K0V77BEvRBJkC
jAPHv+UOIAjW2xXDwTyK
=OByZ
-----END PGP SIGNATURE-----