# CVE-1999-1572: GNU cpio insecure file permissions via 0 umask in archive creation

Source: https://junglewise.ai/threats/cve-1999-1572-gnu-cpio-insecure-file-permissions-via-0-umask-in-archive-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-07-16. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1572 · Severity: low · CVSS 2.1 · Published 1996-07-16

A vulnerability in the cpio archive utility allows the creation of files with insecure permissions. When creating archives, the tool may ignore system security settings and create files that are readable and writeable by any user on the system. This could allow unauthorized local users to view or modify sensitive archived data.

Technologies: [Gnu Cpio](https://junglewise.ai/threats/technologies/cpio). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-1999-1572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1572 being exploited in the wild.

**How severe is CVE-1999-1572?** Low severity, with a CVSS score of 2.1, published 16 July 1996.

**Which products and versions are affected?** Debian Project Debian GNU/Linux 3.0; Gnu Cpio 2.5 and earlier.

**Is there a fix for CVE-1999-1572?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1572 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-1572?** Check whether you run Debian Project Debian GNU/Linux or Gnu Cpio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The cpio utility fails to respect the user's umask when creating archive files using the -O (archive) or -F options. Specifically, it sets a umask of 0 during file creation, resulting in files being created with mode 0666 (world-readable and world-writable). A local attacker can exploit this to read sensitive information from the archives or modify the archive contents to inject malicious data. The issue was originally identified in older versions of cpio and reappeared in later versions due to a regression or lack of backported fixes. Patches are available for affected distributions including Debian, Red Hat, and Ubuntu.

## Affected products

- GNU cpio 2.5 and earlier
- FreeBSD Project FreeBSD 2.1.0
- Debian Project Debian GNU/Linux 3.0
- Canonical Ubuntu Linux 4.10

## Timeline

- 1996-07-16: disclosed: Initial disclosure date recorded in NVD
- 2005-02-04: advisory: Ubuntu Security Notice USN-75-1 published
- 2007-03-14: other: Red Hat official statement regarding RHEL 5 status

## References

- [http://marc.info/?l=bugtraq&m=110763404701519&w=2](http://marc.info/?l=bugtraq&m=110763404701519&w=2)
- [http://secunia.com/advisories/14357](http://secunia.com/advisories/14357)
- [http://secunia.com/advisories/17063](http://secunia.com/advisories/17063)
- [http://secunia.com/advisories/17532](http://secunia.com/advisories/17532)
- [http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf](http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf)
- [http://www.debian.org/security/2005/dsa-664](http://www.debian.org/security/2005/dsa-664)
- [http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391](http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391)

## Related threats

- [cpio stack-based buffer overflow in tar header](https://junglewise.ai/threats/cve-2026-126831-a-flaw-was-found-in-cpio-a-local-user-can-cause-a-denial-of)
- [GNU cpio improper encoding of archive listing output](https://junglewise.ai/threats/cve-2026-66486-gnu-cpio-improper-encoding-of-archive-listing-output)
- [GNU cpio uncontrolled stack memory allocation in make_path](https://junglewise.ai/threats/cve-2026-66485-gnu-cpio-uncontrolled-stack-memory-allocation-in-make-path)
- [GNU cpio path traversal in tar hard-link extraction](https://junglewise.ai/threats/cve-2026-66484-gnu-cpio-path-traversal-in-tar-hard-link-extraction)
- [GStreamer heap buffer overflow in FLIC decoder](https://junglewise.ai/threats/cve-2016-9636-gstreamer-heap-buffer-overflow-in-flic-decoder)