CVE-1999-1572
The MITRE CVE dictionary describes this issue as:
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Find out more about CVE-1999-1572 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 4 (cpio) | RHSA-2005:073 | 2005-02-15 |
| Red Hat Enterprise Linux 3 (cpio) | RHSA-2005:080 | 2005-02-18 |
| Red Hat Enterprise Linux 2.1 | RHSA-2005:806 | 2005-11-10 |
Acknowledgements
Red Hat would like to thank Mike O'Connor for bringing this issue to our attention.CVE description copyright © 2017, The MITRE Corporation