================================ Zip bad default file-permissions vulnerability ================================ Software: Zip Version: 2.31 Software URL: <http://www.info-zip.org/Zip.html> Platform: Unix, Linux. Vulnerability type: File permission, privacy. Severity: Medium. Allows local user to read files belonging to the gzip user which they couldn't otherwisre. Vulnerable software ==================== Zip 2.31 and previous versions running on unix. Vulnerability ============== A zip file created by Zip 2.3.1 has the permissions 644 by default, Therefore any file compressed becomes world readable. Particularly at risk are backup systems which zip password files, databases and other confidential files which are only meant to be readable by a single user or group. Workaround ======== None at the moment, It should be straightforward to fix in the source by setting the umask correctly. -- Imran Ghory
