From: Quintus <quintus@...>
Date: 2012-07-24T23:44:27+09:00
Subject: Re: rubyzip gem overwrites write-protected root-owned file

Am 24.07.2012 14:44, schrieb Wybo Dekker:
> I'm playing with the rubyzip gem, and found, with this little script:
> 
> require 'rubygems'
> require 'zip/zip'
> Zip::ZipFile.open('test.zip', Zip::ZipFile::CREATE) do |zipfile|
>     zipfile.add('rgb.txt','/etc/X11/rgb.txt')
> end
> 
> that 'test.zip' is written without any warning, even if it exists, is
> root-owned and write-protected. Is that a bug?

If you can overwrite a root-owned file not writable by neither a group
you���re in nor for others (i.e. something like rw------- root:root), then
you have a serious security problem (which has nothing to do with Ruby).
Check your system settings (and you���re sure you don���t run this as root?).

Vale,
Marvin

-- 
Blog: http://pegasus-alpha.eu/blog

ASCII-Ribbon-Kampagne        ()   | ASCII Ribbon Campaign        ()
- Stoppt HTML-E-Mail         /\   | - Against HTML E-Mail        /\
- Stoppt propriet��re Anh��nge      | - Against proprietary attachments
www.asciiribbon.org/index-de.html | www.asciiribbon.org