#VU17096 Backdoor in PEAR


Published: 2019-01-21

Vulnerability identifier: #VU17096

Vulnerability risk: Critical

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-912

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PEAR
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote attacker to compromise the affected system.

The issue exists within the PHP PEAR software, downloaded from the official repository within the last 6 month. Unknown attackers compromised the official repository and implanted malicious code into it.

If you have updated your PEAR installation within the last 6 month, most likely your server is compromised.

Mitigation
Update to version 1.10.9.

Vulnerable software versions

PEAR: 1.10.7 - 1.10.8

External links
http://blog.pear.php.net/2018/12/20/security-vulnerability-announcement-archive_tar/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Backdoor in PHP PEAR