CWE-278, Insecure Preserved Inherited Permissions, describes a product that inherits insecure permissions for an object, for example when copying from an archive file, without the user knowing or being involved.
It affects installers, extraction tools, backup and restore utilities, and any code that unpacks files from an outside source.
How it happens
Archive formats such as tar can record file modes and ownership. A tool that restores those values faithfully will recreate a world-writable file even if the user never intended it. The user sees a successful extraction and has no idea the result is permissive.
MITRE's example, CVE-2005-1724 (Gold), is a product that does not obey the specified permissions when exporting.
What an attacker gains
MITRE lists confidentiality and integrity impact: reading and modifying application data. Another local user can read files that should be private, or replace a file that will later be executed or trusted.
How to find it
- After extracting or restoring, list modes and look for group or world write bits.
- Compare the modes in the archive with what your policy allows.
- Review installer scripts for blanket permission restoration.
tar -tvf package.tar | grep -E '^.{8}w'
How to fix it
- Extract with options that do not preserve source permissions, then set explicit modes yourself.
- Apply a restrictive umask before extraction.
- Validate modes of unpacked files before using them.
umask 027
tar -xf package.tar --no-same-permissions
Quick check
Why not just trust the archive's recorded modes?
The archive may come from someone else, and the modes it records may be broader than your policy. Restoring them blindly can silently expose files.
Sources
- MITRE CWE-278: https://cwe.mitre.org/data/definitions/278.html
- Safeguard Gold entry: https://gold.safeguard.sh/cwe/CWE-278
