The PEAR Installer contains a flaw as the package.xml file creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the download_dir, cache_dir, tmp_dir, and pear-build-download directories to cause the program to unexpectedly overwrite an arbitrary file.

It has been reported that this issue has been fixed. Upgrade to version 1.9.2, or higher, to address this vulnerability.

• CVE ID: 2011-1072 (see also: NVD) 2011-1144 (see also: NVD)
• Secunia Advisory ID: 43533 44405 47144 47890 48828
• Bugtraq ID: 46605
• ISS X-Force ID: 65721 65911
• Vendor Specific News/Changelog Entry: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546164
  http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00005.html
  http://news.php.net/php.pear.cvs/61264
  http://pear.php.net/advisory-20110228.txt
  http://pear.php.net/bugs/bug.php?id=18056
  http://security-tracker.debian.org/tracker/CVE-2011-1072
  http://svn.php.net/viewvc?view=revision&revision=308687
  http://www.debian.org/security/2012/dsa-2408
• Other Advisory URL: http://openwall.com/lists/oss-security/2011/02/28/12
  http://openwall.com/lists/oss-security/2011/02/28/3
  http://openwall.com/lists/oss-security/2011/02/28/5
  http://openwall.com/lists/oss-security/2011/03/01/4
  http://openwall.com/lists/oss-security/2011/03/01/5
  http://openwall.com/lists/oss-security/2011/03/01/7
  http://openwall.com/lists/oss-security/2011/03/01/8
  http://openwall.com/lists/oss-security/2011/03/01/9
  http://pear.php.net/bugs/bug.php?id=18056
  http://www.mandriva.com/security/advisories?name=MDVSA-2011:187
• Vendor URL: http://pear.php.net/package/PEAR
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1126-1/
  http://www.ubuntu.com/usn/usn-1126-2/
• RedHat RHSA: RHSA-2011:1741

• Ondrej Surý