Re: Zip 2,31 bad default file-permissions vulnerability

[Imran Ghory <imranghory@xxxxxxxxx>]

On 8/4/05, Lupe Christoph <lupe@xxxxxxxxxxxxxxxxx> wrote:
> Quoting Imran Ghory <imranghory@xxxxxxxxx>:
> 
> > A zip file created by Zip 2.3.1 has the permissions 644 by default,
> > Therefore any file compressed becomes world readable.
> 
> Zip 2.3 works correctly:
> $ (umask 0; zip test.zip feedlist.opml; ls -l test.zip; rm test.zip)
>  adding: feedlist.opml (deflated 80%)
> -rw-rw-rw-    1 lupe     lupe         3156 Aug  4 10:52 test.zip

A clarification: Zip obeys the umask, the example I gave was due to
most unix distributions having a default umask which makes new files
world readable. Contrast this with gzip/bzip2 which will ignore the
umask and preserve the permissions of the file being compressed.

Imran Ghory