Bugzilla Bug 111525

SECURITY VULNERABILITY ANNOUNCEMENT
November 4, 2005

     Advisory: PEAR installer arbitrary code execution vulnerability
 Release Date: 2005/11/04
Last Modified: 2005/11/04
       Author: Gregory Beaver [cellog@php.net]

  Application: PEAR installer <= 1.4.2
     Severity: A standard feature of the PEAR installer implemented in
               all versions of PEAR can lead to the execution of
               arbitrary PHP code upon running the "pear" command
               or loading the Web/Gtk frontend.
         Risk: Low
Vendor Status: The PEAR project has released an updated version
   References: http://pear.php.net/advisory-20051104.txt


Overview:

  The PEAR installer is available from http://pear.php.net/package/PEAR.
The PEAR installer is used to install PHP-based software packages
distributed from pear.php.net and PHP extensions from pecl.php.net.  As
of version 1.4.0, the PEAR installer can also install software packages
from other sources, known as "channels."

A poorly-implemented feature allows a package installed by the PEAR
installer to execute arbitrary code any time the "pear" command is
executed or the Web/Gtk frontend is loaded.

Details:

  To be vulnerable, a user must explicitly install a publicly released
malicious package using the PEAR installer, or explicitly install a
package that depends on a malicious package.

Full details of the vulnerability will be released at a later date.

Proof of concept:

  The PEAR development team will not release an example exploit to the
public.

Disclosure Timeline:

  01. November 2005 - vulnerability discovered by Gregory Beaver
  02. November 2005 - possible solutions discussed privately
  03. November 2005 - The PEAR Project releases new bugfixed version
  04. November 2005 - Public disclosure

Recommendation:

  We strongly recommend to upgrade to the new version

  PEAR 1.4.3
  pear upgrade PEAR-1.4.3
  http://pear.php.net/get/PEAR-1.4.3.tgz

Reproducible: Always
Steps to Reproduce:
1.
2.
3.




Latest version is 1.4.4, not 1.4.3 (patched version did not work with PHP 4.2).

The pear installer is included in all php-archives. All php ebuilds depend on
vulnable PEAR versions, if "pear" USE flag is set. 

pear? ( >=dev-php/PEAR-PEAR-1.3.6 )

http://greg.chiaraquartet.net/archives/99-Security-Vulnerability-in-all-PEAR-versions-prior-to-1.4.3-discovered.html

php please advise. 

We have an ebuild for PEAR 1.4.X in our SVN Overlay, but that still needs some
work/testing PEAR 1.4.0 introduced a lot of changes to the PEAR infrastructure.

I added an ebuild for PEAR-1.4.4 there, but as Sebastian wrote, PEAR-1.4
ebuilds
are in experimental tree of the overlay.

http://svn.gnqs.org/projects/gentoo-php-overlay/browser/experimental/dev-php/PEAR-PEAR/

"To be vulnerable, a user must explicitly install a publicly released malicious
package using the PEAR installer, or explicitly install a package that depends
on a malicious package."

If you install a malicious package, it's probably to run the code in it, so
you're pretty much already 0wned...

Anyway, this is minor, but should nevertheless be fixed. It can wait until it
is
de-experimentalized, I suppose.

Any news on this one? 

Hm, any ETA for having latest PEAR in ? Otherwise I would just close this one,
it sucks anyway.

Bah, closing as wontfix, see comment #4. Feel free to upgrade the package
though.

FYI:
http://greg.chiaraquartet.net/archives/107-Why-it-is-very-important-to-upgrade-to-PEAR-1.4.6-from-PEAR-1.3.x.html

*** Bug 118262 has been marked as a duplicate of this bug. ***

reopening like requested because of new information about the issue, waiting
for ebuilds.

PHP herd, what would be your opinion on this ? I don't find the
Why-it-is-very-important-to-upgrade-to-PEAR-1.4.6-from-PEAR-1.3.x.html very
convincing.

Yeah, we'll anyway to try to have PEAR 1.4.X in the tree soon, as it is a
"better" PEAR installer than 1.3.X, and it fixes the security bugs, but atm
it's a no-go: only >=1.4.6 has the --packagingroot directive wich we need to
let PEAR packages be built correctly in the sandbox, but atm PEAR 1.4.6 only
gives us a Fatal Error and dies, so we can't really ship that... :) We'll try
to fix that and have a working PEAR 1.4.X in the tree soon, I hope.
Best regards, CHTEKK.

There is also this thing, from Bugtraq... Not sure how accessible it is though.

=========================
A vulnerability exists within version 0.2.2 of go-pear.php, part of PHP's PEAR
Package. 
The problem lies in the scripts capacity to utilize a proxy server.

An attacker can take advantage of this option by providing it with a malicious
proxy server
that is configured to redirect the original request to another file server. 
By simply mirroring the requested content from the intended file server 
the attacker can assure the script continues running uninterrupted.

Hosting a modified version of "Tar.php" and pre pending code to the
extractModify() function
will allow the attacker to run any PHP code of their choosing. This occurs
because go-pear uses
"Tar.php" to extract all the packages it previously retrieved, in doing so it
invokes the now
compromised version of extractModify().
=====================================

UPDATE: we got PEAR-1.4.6 working on the PHP Overlay, I'll do some more testing
today and move it to the testing/ branch of the overlay, and then to Portage
CVS on monday if there are no problems found. Once it's in Portage, I'll update
this bug and we can see to have the arch-teams keyword it appropriately.
Best regards, CHTEKK.

Great news, Luca. Could you look at the issue I emailed you about (eZ
components channel registration)? Thanks!

dev-php/PEAR-PEAR-1.4.6 is in the tree now.

arches - please test and mark stable, thx.

x86 done

stable on ppc64

sparc stable.

ppc stable

Marked ~hppa.

amd64 stable

re-CCing hppa as the keyword was removed by the php team to prohobit problems
because of other packages that need to be stabled first, see bug #119461 for
details.

We (hppa) have some problems with php at the moment. Because we aren't php 5
ready. I hope we'll fix it soon.

Alpha stable.

(In reply to comment #26)
> We (hppa) have some problems with php at the moment. Because we aren't php 5
> ready. I hope we'll fix it soon.

Killerfox, if you have issues w/ php-5 on hppa, please keyword dev-lang/php-4
(and related ebuilds) only meanwhile, you don't need php-5 keyworded for
PEAR-PEAR-1.4.6-r1. Thanks.

Marked stable on hppa. Removing CC.

let's better have a glsa vote here ... i have no opinion yet, need to re-read
all the dirty details before

I vote NO.

concur - vote=no glsa

Voting no and closing, this one doesn't smell right, see my comment #4