Description
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.5-1.2 | — |
| Debian 13 | cpio | 2.5-1.2 | — |
| Debian 12 | cpio | 2.5-1.2 | — |
| Debian 3.0 | cpio | 2.4.2-39woody1 | DSA-664-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cpio | 2.5-7.EL4.1 | RHSA-2005:073 |
| RHEL 3 | cpio | 2.5-3e.3 | RHSA-2005:080 |
Advisories 3
- RHSA-2005:080 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:073 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-664-1 cpio - broken file permissions Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20050204 [USN-75-1] cpio vulnerability mailing-list
- RHSA-2005:073 vendor-advisory
- cpio-o-archive-insecure-permissions(19167) vdb-entry
- 17063 third-party-advisory
- 17532 third-party-advisory
- 2005-0003 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2005-212.pdf
- RHSA-2005:080 vendor-advisory
- oval:org.mitre.oval:def:10888 vdb-entry signature
- http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391
- 14357 third-party-advisory
- MDKSA-2005:032 vendor-advisory
- DSA-664 vendor-advisory
- RHSA-2005:806 vendor-advisory