Bug 1182024 (CVE-2015-1200)

Summary: CVE-2015-1200 pxz: race condition in setting permissions on output file
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: novyjindrich
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:37:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1182025, 1182026    
Bug Blocks:    

Description Vasyl Kaigorodov 2015-01-14 10:29:06 UTC 
It was reported [1] that pxz sets the mode of an output file to be the same as the one of an input file but does it only after compression is over. This leaves the output file with the wrong mode during all the time of the compression process.

Illustration:

$ truncate -s 1G foo
$ chmod 600 foo
$ pxz foo &
[1] 9240
$ ls -l foo.xz
-rw-r--r-- 1 user user 0 Jan 14 00:33 foo.xz
$ wait %
[1]+  Done                    pxz foo
$ ls -l foo.xz
-rw------- 1 user user 161976 Jan 14 00:33 foo.xz

The issue is similar to 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0296

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775306
Comment 1 Vasyl Kaigorodov 2015-01-14 10:29:28 UTC 
Created pxz tracking bugs for this issue:

Affects: fedora-all [bug 1182025]
Affects: epel-6 [bug 1182026]
Comment 2 Product Security DevOps Team 2019-06-08 02:37:56 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.