oss-security - CVE request(?): gpg: improper file permssions set when en/de-crypting files

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201209211220.20425.mweckbecker@suse.de>
Date: Fri, 21 Sep 2012 12:20:20 +0200
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Cc: vcizek@...e.de, tmraz@...hat.com
Subject: CVE request(?): gpg: improper file permssions set when en/de-crypting files

Hello Steve, Kurt, Vitezslav, Tomas, vendors,

we have recently been notified about a potential issue with gpg: When files
are en/de-crypted the result is written world-readable by default.
Short example (quote from [1]):

 # de-crypting
 % gpg sikrit.gpg
 % ll sikrit*
   -rw-r--r-- 1 gp users  12 Sep 17 09:41 sikrit
   -rw------- 1 gp users 480 Sep 17 09:40 sikrit.gpg
 # en-crypting
 % echo "my password" > sikrit
 % chmod go= sikrit
 % ll sikrit
   -rw------- 1 gp users 12 Sep 17 09:38 sikrit
 % gpg -e -r pfeifer sikrit
 % wipe sikrit
 % ll sikrit.gpg 
   -rw-r--r-- 1 gp users 480 Sep 17 09:40 sikrit.gpg

[1] https://bugzilla.novell.com/show_bug.cgi?id=780943

Wouldn't one usually expect files that were previously encrypted to contain
sensitive content (that's probably why content is encrypted at all)? And if
so, shouldn't such files be only readable by certain users / group of users
by default? Otherwise, a file that is e.g. decrypted in /tmp might leak due
to the file permissions being too loose.

I'm not quite sure whether to assign a CVE for this, so I thought I'd just
add a question mark behind the subject and let the list (and Kurt) decide.

Thanks, Matthias

-- 
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.