CVE-1999-1572: cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when crea...

Security readout for executives and security teams

This is an old local-permissions flaw in cpio. When creating archive files with certain options, cpio could make those files world-readable and world-writable. On affected multi-user systems, another local user could read or overwrite archives that should have been protected. Exposure is most plausible on legacy Unix/Linux systems running vulnerable cpio packages, especially multi-user hosts or scripts that create archives with -O or -F in accessible locations. Treat as low priority unless legacy multi-user Unix/Linux systems remain in use. The business risk is unauthorized local access to archive data, not remote takeover. Mitigation focus: Check listed vendor advisories for affected package versions and corrected cpio updates.; Upgrade or retire legacy operating systems named by the advisories.; Restrict local shell access on systems that still run affected cpio versions..

Prepared

Jun 30, 2026, 01:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.