CVE-1999-1572
LowExploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The cpio program on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems uses a 0 umask when creating files with the -O (archive) or -F options, resulting in files being created with mode 0666.
Risk Assessment
Local users may be able to read or overwrite these files, posing a risk of unauthorized access to data.
Recommendation
It is recommended to change the umask to a more restrictive value before using the -O or -F options to limit access to the created files.
Other vulnerabilities in cpio
See all- CVE-2023-7216Medium
A path traversal vulnerability was found in the CPIO utility. During extraction, the archiver could follow symlinks outside of the intended directory, allowing files to be written in arbitrary directories through symlinks.
- CVE-2015-1197Low
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Original NVD description (English source)
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS