Junglewise Threat Intelligence

CVE-1999-1572: GNU cpio insecure file permissions via 0 umask in archive creation

CVE-1999-1572 · Severity: low · CVSS 2.1 · Published 1996-07-16

Technologies: FreeBSD Project Freebsd, Gnu Cpio. Vendors: Gnu, Canonical.

Executive brief

A vulnerability in the cpio archive utility allows the creation of files with insecure permissions. When creating archives, the tool may ignore system security settings and create files that are readable and writeable by any user on the system. This could allow unauthorized local users to view or modify sensitive archived data.

Technical details

The cpio utility fails to respect the user's umask when creating archive files using the -O (archive) or -F options. Specifically, it sets a umask of 0 during file creation, resulting in files being created with mode 0666 (world-readable and world-writable). A local attacker can exploit this to read sensitive information from the archives or modify the archive contents to inject malicious data. The issue was originally identified in older versions of cpio and reappeared in later versions due to a regression or lack of backported fixes. Patches are available for affected distributions including Debian, Red Hat, and Ubuntu.

Affected products

  • GNU cpio 2.5 and earlier
  • FreeBSD Project FreeBSD 2.1.0
  • Debian Project Debian GNU/Linux 3.0
  • Canonical Ubuntu Linux 4.10

Timeline

  • 1996-07-16: disclosed: Initial disclosure date recorded in NVD
  • 2005-02-04: advisory: Ubuntu Security Notice USN-75-1 published
  • 2007-03-14: other: Red Hat official statement regarding RHEL 5 status

References

Related threats