Bug 735613

Summary: VUL-1: CVE-2011-1072: php-pear: symlink vulnerability in PEAR installer
Product: [Novell Products] SUSE Security Incidents Reporter: Matthias Weckbecker <mweckbecker>
Component: GeneralAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P3 - Medium CC: security-team
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: maint:running:44760:important maint:released:sle11-sp1:45903 maint:running:53557:important maint:released:sle10-sp3:53743
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Matthias Weckbecker 2011-12-08 12:52:54 UTC 
"Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1072 to
the following vulnerability:

Name: CVE-2011-1072
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1072
Assigned: 20110224
Reference: http://openwall.com/lists/oss-security/2011/02/28/3
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546164
Reference: http://news.php.net/php.pear.cvs/61264
Reference: http://pear.php.net/advisory-20110228.txt
Reference: http://pear.php.net/bugs/bug.php?id=18056
Reference: http://security-tracker.debian.org/tracker/CVE-2011-1072
Reference: http://svn.php.net/viewvc?view=revision&revision=308687
Reference: http://www.securityfocus.com/bid/46605
Reference: http://secunia.com/advisories/43533
Reference: http://xforce.iss.net/xforce/xfdb/65721

The installer in PEAR before 1.9.2 allows local users to overwrite
arbitrary files via a symlink attack on the package.xml file, related
to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4)
pear-build-download directories, a different vulnerability than
CVE-2007-2519.


Note that PEAR 1.9.2 did not fully correct the issue, and MITRE assigned CVE-2011-1144 to that:

The installer in PEAR 1.9.2 and earlier allows local users to
overwrite arbitrary files via a symlink attack on the package.xml
file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and
(4) pear-build-download directories.  NOTE: this vulnerability exists
because of an incomplete fix for CVE-2011-1072.

References to the incomplete fix:

http://openwall.com/lists/oss-security/2011/03/01/9

So if we do update to 1.9.2 without the full fix, then CVE-2011-1144 applies as 1.9.2 contains an incomplete fix.

It also does not look like older versions of PEAR (e.g. 1.4.9 as found in Red Hat Enterprise Linux 5) are vulnerable as there is no specific download directory or temporary directory specifications used (download_dir, temp_dir), and the default cache directory is /var/cache/php-pear which is owned root:root and mode 0755 (not a world-writable /tmp)." -- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1072
Comment 1 Petr Gajdos 2011-12-19 15:51:23 UTC 
We ship 1.9.4 along with php 5.3.8, which means factory, 12.1 and 11sp2/php53 aren't affected.
Comment 2 Petr Gajdos 2011-12-20 09:43:54 UTC 
Other distributions (10sp3 - 11.4) have 1.9.1. I propose to update to 1.9.4 for all of them.

Changelog 1.9.1 -> 1.9.4 can be found here:
http://pear.php.net/package/PEAR/download/1.9.4

1.9.{2,3,4} seem to be bug fixing releases with top-ranked security bug in question.
Comment 3 Petr Gajdos 2011-12-27 13:54:31 UTC 
10sp3: 17012
11sp1: 17013
11sp2: 17014
Comment 4 Bernhard Wiedemann 2012-01-05 11:00:39 UTC 
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/98849 11.3 / php5
https://build.opensuse.org/request/show/98850 11.4 / php5
Comment 5 Bernhard Wiedemann 2012-04-02 16:00:29 UTC 
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/112241 Evergreen:11.2 / php5
Comment 6 Bernhard Wiedemann 2012-04-10 05:00:33 UTC 
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/113051 Evergreen:11.2 / php5
Comment 7 Swamp Workflow Management 2012-04-12 17:53:11 UTC 
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-debugsource, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 8 Matthias Weckbecker 2012-04-13 09:39:39 UTC 
released
Comment 9 Swamp Workflow Management 2013-08-16 15:48:12 UTC 
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mhash, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 10-SP3 (i386, s390x, x86_64)
SLE-SERVER 10-SP3-LTSS (i386, s390x, x86_64)