AFP Server for Mac OS X 10.4.1, when using an ACL enabled volume, does not properly remove an ACL when a file is copied to a directory that does not use ACLs, which will override the POSIX file permissions for that ACL.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2005-1722
http://lists.apple.com/archives/security-announce/2005/Jun/msg00000.html