Bug 735613 - VUL-1: CVE-2011-1072: php-pear: symlink vulnerability in PEAR installer
VUL-1: CVE-2011-1072: php-pear: symlink vulnerability in PEAR installer
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Minor
: ---
Assigned To: Security Team bot
Security Team bot
maint:running:44760:important maint:r...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-12-08 12:52 UTC by Matthias Weckbecker
Modified: 2013-08-16 15:48 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Weckbecker 2011-12-08 12:52:54 UTC
"Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1072 to
the following vulnerability:

Name: CVE-2011-1072
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1072
Assigned: 20110224
Reference: http://openwall.com/lists/oss-security/2011/02/28/3
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546164
Reference: http://news.php.net/php.pear.cvs/61264
Reference: http://pear.php.net/advisory-20110228.txt
Reference: http://pear.php.net/bugs/bug.php?id=18056
Reference: http://security-tracker.debian.org/tracker/CVE-2011-1072
Reference: http://svn.php.net/viewvc?view=revision&revision=308687
Reference: http://www.securityfocus.com/bid/46605
Reference: http://secunia.com/advisories/43533
Reference: http://xforce.iss.net/xforce/xfdb/65721

The installer in PEAR before 1.9.2 allows local users to overwrite
arbitrary files via a symlink attack on the package.xml file, related
to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4)
pear-build-download directories, a different vulnerability than
CVE-2007-2519.


Note that PEAR 1.9.2 did not fully correct the issue, and MITRE assigned CVE-2011-1144 to that:

The installer in PEAR 1.9.2 and earlier allows local users to
overwrite arbitrary files via a symlink attack on the package.xml
file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and
(4) pear-build-download directories.  NOTE: this vulnerability exists
because of an incomplete fix for CVE-2011-1072.

References to the incomplete fix:

http://openwall.com/lists/oss-security/2011/03/01/9

So if we do update to 1.9.2 without the full fix, then CVE-2011-1144 applies as 1.9.2 contains an incomplete fix.

It also does not look like older versions of PEAR (e.g. 1.4.9 as found in Red Hat Enterprise Linux 5) are vulnerable as there is no specific download directory or temporary directory specifications used (download_dir, temp_dir), and the default cache directory is /var/cache/php-pear which is owned root:root and mode 0755 (not a world-writable /tmp)." -- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1072
Comment 1 Petr Gajdos 2011-12-19 15:51:23 UTC
We ship 1.9.4 along with php 5.3.8, which means factory, 12.1 and 11sp2/php53 aren't affected.
Comment 2 Petr Gajdos 2011-12-20 09:43:54 UTC
Other distributions (10sp3 - 11.4) have 1.9.1. I propose to update to 1.9.4 for all of them.

Changelog 1.9.1 -> 1.9.4 can be found here:
http://pear.php.net/package/PEAR/download/1.9.4

1.9.{2,3,4} seem to be bug fixing releases with top-ranked security bug in question.
Comment 3 Petr Gajdos 2011-12-27 13:54:31 UTC
10sp3: 17012
11sp1: 17013
11sp2: 17014
Comment 4 Bernhard Wiedemann 2012-01-05 11:00:39 UTC
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/98849 11.3 / php5
https://build.opensuse.org/request/show/98850 11.4 / php5
Comment 5 Bernhard Wiedemann 2012-04-02 16:00:29 UTC
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/112241 Evergreen:11.2 / php5
Comment 6 Bernhard Wiedemann 2012-04-10 05:00:33 UTC
This is an autogenerated message for OBS integration:
This bug (735613) was mentioned in
https://build.opensuse.org/request/show/113051 Evergreen:11.2 / php5
Comment 7 Swamp Workflow Management 2012-04-12 17:53:11 UTC
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-debugsource, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-FOR-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 8 Matthias Weckbecker 2012-04-13 09:39:39 UTC
released
Comment 9 Swamp Workflow Management 2013-08-16 15:48:12 UTC
Update released for: apache2-mod_php5, php5, php5-bcmath, php5-bz2, php5-calendar, php5-ctype, php5-curl, php5-dba, php5-dbase, php5-debuginfo, php5-devel, php5-dom, php5-exif, php5-fastcgi, php5-ftp, php5-gd, php5-gettext, php5-gmp, php5-hash, php5-iconv, php5-imap, php5-json, php5-ldap, php5-mbstring, php5-mcrypt, php5-mhash, php5-mysql, php5-ncurses, php5-odbc, php5-openssl, php5-pcntl, php5-pdo, php5-pear, php5-pgsql, php5-posix, php5-pspell, php5-readline, php5-shmop, php5-snmp, php5-soap, php5-sockets, php5-sqlite, php5-suhosin, php5-sysvmsg, php5-sysvsem, php5-sysvshm, php5-tidy, php5-tokenizer, php5-wddx, php5-xmlreader, php5-xmlrpc, php5-xmlwriter, php5-xsl, php5-zip, php5-zlib
Products:
SLE-DEBUGINFO 10-SP3 (i386, s390x, x86_64)
SLE-SERVER 10-SP3-LTSS (i386, s390x, x86_64)