Page History

...

Using the POSIX function open() to create a file but failing to provide access permissions for that file may cause that file to be created with unintended access permissions. This omission has been known to lead to vulnerabilities; for instance, CVE-2006-1174.

...
int fd = open(file_name, O_CREAT | O_WRONLY); /* access permissions are missing */
if (fd == -1){
  /* Handle Error */
}
...

...

The fopen() function does not provide a mechanism to specify file access permissions. In the example below, if the call to fopen() creates a new file, the access permissions for that file will be implementation defined.

 
...
FILE * fptr = fopen(file_name, "w");
if (!fptr){
  /* Handle Error */
}
...

...

References

• ISO/IEC 9899-1999 Section 7.19.5.3, The fopen function
• Open Group 04 The open function
• ISO/IEC TR 24731-2006 Section 6.5.2.1, The fopen_s function
• CVE-2006-1174