Your web server log should contain more information about what's going wrong. Default permissions from extracting the zip archive (owner root, mode 0644) should work just fine. Avatars are stored in the database by default, so file permissions shouldn't matter there. So, as already stated, please check your web server logs.