.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files. NIST National Vulnerability Database (NVD) -- services.nvd.nist.gov (CVE / CVSS / CPE). {"cve":{"id":"CVE-1999-1572","sourceIdentifier":"cve@mitre.org","published":"1996-07-16T04:00:00.000","lastModified":"2026-06-16T21:50:44.777","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:N/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*","matchCriteriaId":"2CAE037F-111C-4A76-8FFE-716B74D65EF3"},{"vulnerable":true,"criteria":"cpe:2.3:o:freebsd:freebsd:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"27C9E23D-AB82-4AE1-873E-C5493BB96AA1"},{"vulnerable":true,"criteria":"cpe:2.3:o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*","matchCriteriaId":"4177C378-7729-46AB-B49B-C6DAED3200E7"},{"vulnerable":true,"criteria":"cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"A06E5CD0-8BEC-4F4C-9E11-1FEE0563946C"},{"vulnerable":true,"criteria":"cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*","matchCriteriaId":"3528DABD-B821-4D23-AE12-614A9CA92C46"},{"vulnerable":true,"criteria":"cpe:2.3:o:mandrakesoft:mandrake_linux:cs2.1:*:*:*:*:*:*:*","matchCriteriaId":"B5B3DB31-3998-4B75-A972-0F2675ACCA2C"},{"vulnerable":true,"criteria":"cpe:2.3:o:mandrakesoft:mandrake_linux:cs3.0:*:*:*:*:*:*:*","matchCriteriaId":"37145402-6EC5-4700-8863-CE563A4F37F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:4.0:*:advanced_server:*:*:*:*:*","matchCriteriaId":"F9440B25-D206-4914-9557-B5F030890DEC"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:4.0:*:enterprise_server:*:*:*:*:*","matchCriteriaId":"E9933557-3BCA-4D92-AD4F-27758A0D3347"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:4.0:*:workstation:*:*:*:*:*","matchCriteriaId":"10A60552-15A5-4E95-B3CE-99A4B26260C1"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*","matchCriteriaId":"7D74A418-50F0-42C0-ABBC-BBBE718FF025"},{"vulnerable":true,"criteria":"cpe:2.3:o:ubuntu:ubuntu_linux:4.10:*:*:*:*:*:*:*","matchCriteriaId":"C62EF915-CA7C-4D75-BC67-E015772BB9CF"}]}]}],"references":[{"url":"http://marc.info/?l=bugtraq&m=110763404701519&w=2","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/14357","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/17063","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/17532","source":"cve@mitre.org"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf","source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2005/dsa-664","source":"cve@mitre.org"},{"url":"http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2005:032","source":"cve@mitre.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-073.html","source":"cve@mitre.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-080.html","source":"cve@mitre.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-806.html","source":"cve@mitre.org"},{"url":"http://www.trustix.org/errata/2005/0003/","source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/19167","source":"cve@mitre.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10888","source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=110763404701519&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/14357","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17063","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17532","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2005/dsa-664","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2005:032","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-073.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-080.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-806.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.trustix.org/errata/2005/0003/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/19167","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10888","source":"af854a3a-2127-422b-91ae-364da2661108"}],"evaluatorSolution":"Fixed in rev 1.3 of cpio/main.c.","vendorComments":[{"organization":"Red Hat","comment":"Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.","lastModified":"2007-03-14T00:00:00"}]}},