cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.

Recently it was discovered that cpio created world-writeable files when used in -o/--create mode with giving an output file (with -O).
This allowed any user to modify the created cpio archives. Now cpio respects the current umask setting of the user.

Note: This vulnerability has already been fixed in a very old version of cpio, but the fix was never ported to the current version.
Therefore the CAN number was assigned to the year 1999.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated cpio package that fixes multiple issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A race condition bug was found in cpio. It is possible for a local malicious user to modify the permissions of a local file if they have write access to a directory in which a cpio archive is being extracted. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1111 to this issue.

It was discovered that cpio uses a 0 umask when creating files using the -O (archive) option. This creates output files with mode 0666 (all users can read and write) regardless of the user's umask setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-1572 to this issue.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes for these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:073 advisory.

    GNU cpio copies files into or out of a cpio or tar archive.

    It was discovered that cpio uses a 0 umask when creating files using the -O     (archive) option.  This creates output files with mode 0666 (all can read     and write) regardless of the user's umask setting.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-1999-1572 to this issue.

    Users of cpio should upgrade to this updated package, which resolves     this issue.

    Red Hat would like to thank Mike O'Connor for bringing this issue to our     attention.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated cpio package that fixes a umask bug and supports large files (>2GB) is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team

GNU cpio copies files into or out of a cpio or tar archive.

It was discovered that cpio uses a 0 umask when creating files using the -O (archive) option. This creates output files with mode 0666 (all can read and write) regardless of the user's umask setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-1572 to this issue.

All users of cpio should upgrade to this updated package, which resolves this issue, and adds support for large files (> 2GB).

A vulnerability in cpio was discovered where cpio would create world- writeable files when used in -o/--create mode and giving an output file (with -O). This would allow any user to modify the created cpio archive. The updated packages have been patched so that cpio now respects the current umask setting of the user.

Update :

The updated cpio packages for 10.1, while they would install with urpmi on the commandline, would not install via rpmdrake. The updated packages correct that.

It has been discovered, that cpio, a program to manage archives of files, creates output files with -O and -F with broken permissions due to a reset zero umask which allows local users to read or overwrite those files.

ID	Name	Product	Family	Severity
20697	Ubuntu 4.10 : cpio vulnerability (USN-75-1)	Nessus	Ubuntu Local Security Checks	low
20204	RHEL 2.1 : cpio (RHSA-2005:806)	Nessus	Red Hat Local Security Checks	low
17181	RHEL 4 : cpio (RHSA-2005:073)	Nessus	Red Hat Local Security Checks	high
17146	RHEL 3 : cpio (RHSA-2005:080)	Nessus	Red Hat Local Security Checks	low
16375	Mandrake Linux Security Advisory : cpio (MDKSA-2005:032-1)	Nessus	Mandriva Local Security Checks	low
16300	Debian DSA-664-1 : cpio - broken file permissions	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-1999-1572

high

Tenable Plugins

low

low

high

low

low

low