Is CVE-1999-1572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1572 being exploited in the wild.

How severe is CVE-1999-1572?

Low severity, with a CVSS score of 2.1, published 16 July 1996.

Which products and versions are affected?

Debian Project Debian GNU/Linux 3.0; Gnu Cpio 2.5 and earlier.

Is there a fix for CVE-1999-1572?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1572 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1572?

Check whether you run Debian Project Debian GNU/Linux or Gnu Cpio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1572: GNU cpio insecure file permissions via 0 umask in archive creation

CVE-1999-1572 · Severity: low · CVSS 2.1 · Published 1996-07-16

A vulnerability in the cpio archive utility allows the creation of files with insecure permissions. When creating archives, the tool may ignore system security settings and create files that are readable and writeable by any user on the system. This could allow unauthorized local users to view or modify sensitive archived data.

Technologies: Gnu Cpio. Vendors: Gnu.

Quick answers

Is CVE-1999-1572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1572 being exploited in the wild.
How severe is CVE-1999-1572?: Low severity, with a CVSS score of 2.1, published 16 July 1996.
Which products and versions are affected?: Debian Project Debian GNU/Linux 3.0; Gnu Cpio 2.5 and earlier.
Is there a fix for CVE-1999-1572?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1572 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1572?: Check whether you run Debian Project Debian GNU/Linux or Gnu Cpio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The cpio utility fails to respect the user's umask when creating archive files using the -O (archive) or -F options. Specifically, it sets a umask of 0 during file creation, resulting in files being created with mode 0666 (world-readable and world-writable). A local attacker can exploit this to read sensitive information from the archives or modify the archive contents to inject malicious data. The issue was originally identified in older versions of cpio and reappeared in later versions due to a regression or lack of backported fixes. Patches are available for affected distributions including Debian, Red Hat, and Ubuntu.

Affected products

GNU cpio 2.5 and earlier
FreeBSD Project FreeBSD 2.1.0
Debian Project Debian GNU/Linux 3.0
Canonical Ubuntu Linux 4.10

Timeline

1996-07-16: disclosed: Initial disclosure date recorded in NVD
2005-02-04: advisory: Ubuntu Security Notice USN-75-1 published
2007-03-14: other: Red Hat official statement regarding RHEL 5 status

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.