CVE-1999-1572: Low severity redhat Enterprise Linux vulnerability
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set a non-zero umask in the environment or wrapper script before invoking cpio so files created with -O or -F are not created with world-writable/readable mode (0666). For example, run `umask 022` in the shell or set umask in scripts that call cpio.
cpio umask = non-zero (e.g., 022) - Configuration
Avoid using the -O or -F options to cpio to create files, or use alternative archive tools that do not force a 0 umask. If -O or -F must be used, ensure the umask is set to a restrictive value before invocation.
cpio use_of_-O_/_-F_options = do not use -O or -F - Operational
Search for files created by cpio with insecure permissions (mode 0666) and remediate them: tighten permissions (for example, chmod to more restrictive modes), remove or re-create sensitive files with a safe umask, and restrict access to any files that were exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1572?
CVE-1999-1572 is classified as a moderate severity vulnerability due to its potential to allow local users to read or overwrite sensitive files.
How do I fix CVE-1999-1572?
To fix CVE-1999-1572, you should update the cpio package to a version that addresses the 0 umask issue.
Which operating systems are affected by CVE-1999-1572?
CVE-1999-1572 affects FreeBSD 2.1.0, Debian GNU/Linux 3.0, and various versions of Mandrake and Red Hat Enterprise Linux.
What does the 0 umask in CVE-1999-1572 mean?
The 0 umask in CVE-1999-1572 means that files created using cpio with the -O or -F options have a mode of 0666, allowing all users to read or write to those files.
Can CVE-1999-1572 be exploited remotely?
CVE-1999-1572 primarily allows for local exploitation, as it requires a local user to have access to the affected systems.