CVE-2013-1425: Incorrect Default Permissions (CWE-276)
value: ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 5.5
Published: 2019-11-07T21:15Z
Repository: https://github.com/elmar/ldap-git-backup
Language: Other
Files changed: README.mdown, configure.ac, debian/changelog, ldap-git-backup.in, t/030_git-from-scratch.t.in
Commit date: 2013-01-28 19:27:49 +0000
Commit message: set default permission 0700 for backup directory

fixes CVE-2013-1425 (local information disclosure)

Diff: diff --git a/README.mdown b/README.mdown
index 733b473..57af6c4 100644
--- a/README.mdown
+++ b/README.mdown
@@ -113,5 +113,6 @@ Since reliable backups are important <code>safe-ldif</code> is the default.
 Over time various people contributed with discussions, ideas, code, and bug reports.
 
 - Axel Beckert <abe@debian.org> (co-maintainer)
 - Florian Ernst <florian\_ernst@gmx.net>
 - Bart Martens <bartm@debian.org>
+- Hans Spaans <hans.spaans@nexit.nl>
diff --git a/configure.ac b/configure.ac
index 9833dac..baff816 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,9 +1,9 @@
 AC_PREREQ([2.67])dnl require version in Debian squeeze (or higher)
 AC_INIT(
     [LDAP Git Backup],
-    [1.0.3],
+    [1.0.4],
     [elmar@heebs.ch],
     [ldap-git-backup],
     [https://github.com/elmar/ldap-git-backup]
 )
 AC_CONFIG_AUX_DIR([build-aux])
diff --git a/debian/changelog b/debian/changelog
index 89bc602..3d9d71d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,13 @@
+ldap-git-backup (1.0.4-1) unstable; urgency=low
+
+  * create backup directory with default mode of 0700
+    fixes CVE-2013-1425 (local information disclosure)
+    Thanks to Hans Spaans <hans.spaans@nexit.nl>
+
+ -- Elmar S. Heeb <elmar@heebs.ch>  Mon, 28 Jan 2013 19:05:13 +0000
+
 ldap-git-backup (1.0.3-2) unstable; urgency=low
 
   * clean up of Depends and Build-Depends
 
  -- Elmar S. Heeb <elmar@heebs.ch>  Thu, 03 Jan 2013 15:07:33 +0100
diff --git a/ldap-git-backup.in b/ldap-git-backup.in
index af1db88..10ae6ac 100644
--- a/ldap-git-backup.in
+++ b/ldap-git-backup.in
@@ -34,11 +34,11 @@ sub main {
     if ( -e $commit_date ) {
         $commit_date = stat($commit_date)->mtime();
     }
 
     my $ldif_aref = LDAP::Utils::read_ldif($ldif_cmd);
-    make_path($backup_dir);
+    make_path($backup_dir, {mode => 0700});
     chdir($backup_dir);
     Git::command('init');
     my $repo = Git->repository(Directory => $backup_dir);
 
     my @filelist = $repo->command('ls-files', '*.ldif');
diff --git a/t/030_git-from-scratch.t.in b/t/030_git-from-scratch.t.in
index ceaa5a8..39bd38a 100644
--- a/t/030_git-from-scratch.t.in
+++ b/t/030_git-from-scratch.t.in
@@ -30,10 +30,13 @@ ok(
         "--backup-dir=$backup_dir",
     ) == 0,
     'first backup should run'
 );
 ok( (-d $backup_dir), 'backup directory should have been created' );
+my $mode = ((stat($backup_dir))[2]) & 0777; # mask only permission part of mode
+$mode = sprintf("%#o", $mode); # string in octal to help readability of assertion
+is( $mode, '0700', 'new backup directory should be created with mode 0700 (rwx------)' );
 ok( (-d "$backup_dir/.git"), 'backup directory should be a GIT repository now');
 
 check_directory_list($backup_dir, qw(
     .
     ..

Vulnerable code:     [1.0.3],
    make_path($backup_dir);
Fixed code: - Hans Spaans <hans.spaans@nexit.nl>
    [1.0.4],
ldap-git-backup (1.0.4-1) unstable; urgency=low

  * create backup directory with default mode of 0700
    fixes CVE-2013-1425 (local information disclosure)
    Thanks to Hans Spaans <hans.spaans@nexit.nl>

 -- Elmar S. Heeb <elmar@heebs.ch>  Mon, 28 Jan 2013 19:05:13 +0000

    make_path($backup_dir, {mode => 0700});
my $mode = ((stat($backup_dir))[2]) & 0777; # mask only permission part of mode
$mode = sprintf("%#o", $mode); # string in octal to help readability of assertion
is( $mode, '0700', 'new backup directory should be created with mode 0700 (rwx------)' );