Link following in PEAR - CVE-2011-1144

Vulnerability identifier: #VU45260

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-1144

CWE-ID: CWE-59

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.

PEAR
Ubuntu
libapache2-mod-php5 (Ubuntu package)
php5-cgi (Ubuntu package)
php5-cli (Ubuntu package)
php5-gd (Ubuntu package)
php5 (Ubuntu package)
php5-dev (Ubuntu package)
php5-common (Ubuntu package)
php5-curl (Ubuntu package)
php-pear (Ubuntu package)
php5-intl (Ubuntu package)

Install update from vendor's website.

libapache2-mod-php5 (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-cgi (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-cli (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-gd (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5 (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-dev (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-common (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-curl (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php-pear (Ubuntu package) - addressed in versions 5.1.2-1ubuntu3.22, 5.2.4-2ubuntu5.15, 5.2.10.dfsg.1-2ubuntu6.9, 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1
php5-intl (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.8, 5.3.3-1ubuntu9.4, 5.3.5-1ubuntu7.1

• http://openwall.com/lists/oss-security/2011/02/28/5
• http://openwall.com/lists/oss-security/2011/03/01/4
• http://openwall.com/lists/oss-security/2011/03/01/5
• http://openwall.com/lists/oss-security/2011/03/01/7
• http://openwall.com/lists/oss-security/2011/03/01/8
• http://openwall.com/lists/oss-security/2011/03/01/9
• http://pear.php.net/bugs/bug.php?id=18056
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65911

• Link following in PEAR
• Ubuntu update for php5