#682157 [php-pear] "/tmp" symlink file clobbering (CVE-2014-5459)

#682157#5
Date:
2012-07-19 20:28:09 UTC
From:
To:
Dear Maintainer,

"pear download" leaves files in /tmp/pear/cache, so that if 2 users use it,
there are interferences because directories and files are only writable by the
user who first ran the command. Other users will then face failures with
unclear messages like this:

$ pear download HTML_Common2

Warning: lstat(): Lstat failed for
/tmp/pear/cache/3fbb9a4a8ce980205256b12627511dacrest.cacheid in PEAR/REST.php
on line 276
PHP Warning:  lstat(): Lstat failed for
/tmp/pear/cache/3fbb9a4a8ce980205256b12627511dacrest.cacheid in
/usr/share/php/PEAR/REST.php on line 276
PHP Stack trace:
PHP   1. {main}() /usr/share/php/pearcmd.php:0
PHP   2. PEAR_Command_Common->run() /usr/share/php/pearcmd.php:305
PHP   3. PEAR_Command_Remote->doDownload()
/usr/share/php/PEAR/Command/Common.php:271
PHP   4. PEAR_Downloader->download() /usr/share/php/PEAR/Command/Remote.php:607
PHP   5. PEAR_Downloader_Package->initialize()
/usr/share/php/PEAR/Downloader.php:279
PHP   6. PEAR_Downloader_Package->_fromString()
/usr/share/php/PEAR/Downloader/Package.php:190
PHP   7. PEAR_Downloader->_getPackageDownloadUrl()
/usr/share/php/PEAR/Downloader/Package.php:1713
PHP   8. PEAR_REST_13->getDownloadURL() /usr/share/php/PEAR/Downloader.php:850
PHP   9. PEAR_REST->retrieveData() /usr/share/php/PEAR/REST/13.php:68
PHP  10. PEAR_REST->saveCache() /usr/share/php/PEAR/REST.php:163
PHP  11. PEAR_REST->saveCacheFile() /usr/share/php/PEAR/REST.php:246
PHP  12. lstat() /usr/share/php/PEAR/REST.php:276
No releases available for package "pear.php.net/HTML_Common2"
download failed

A quick fix would be to default to a tmp dir located in the user's home
directory.

#682157#22
Date:
2015-11-07 13:25:32 UTC
From:
To:
Version: 5.3.6-1

Hello,

According to https://pear.php.net/bugs/bug.php?id=18056, it's fixed since 1.9.2

Regards

#682157#31
Date:
2015-11-07 14:53:07 UTC
From:
To:
2015-11-07 15:05 GMT+01:00 Salvatore Bonaccorso <carnil@debian.org>:

This even introduced a regression on Windows:
https://pear.php.net/bugs/bug.php?id=18834
https://github.com/pear/pear-core/commit/38de9355e3a9c66445a6d39d2c9a20f73e986d9a
(which is in 1.9.2)

And further improvement in:
https://github.com/pear/pear-core/commit/cd31da7d8b5e684f177a8fe700339f7eb2420876
(which is in 1.9.3)

Can we close it then?

Regards

#682157#36
Date:
2015-11-08 06:25:07 UTC
From:
To:
Hi Mathieu,
you cannot globber anymore someone else files. A can block another
user this way.

As user foo do:

foo@sid:~$ pear download HTML_Common2
downloading HTML_Common2-2.1.1.tgz ...
Starting to download HTML_Common2-2.1.1.tgz (8,604 bytes)
.....done: 8,604 bytes
File /home/foo/HTML_Common2-2.1.1.tgz downloaded


then replace the cache files with symlinks (e.g. to files in home of
user bar, since he want's to try to globber these files). bar now is
unable to pear download HTML_Common2:

bar@sid:~$ pear download HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in /usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
download failed
bar@sid:~$ ls
bar@sid:~$

or as root

root@sid:~# pear download HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php
on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in
/usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
download failed
root@sid:~# pear install HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php
on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in
/usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
install failed
root@sid:~#

So again, I don't think the issues with unsafe use of /tmp are fixed
correctly and the bugs should not be closed. PHP maintainers, what do
you think (Ondřej cc'ed)?

Regards,
Salvatore

#682157#39
Date:
2015-11-08 06:25:07 UTC
From:
To:
Hi Mathieu,
you cannot globber anymore someone else files. A can block another
user this way.

As user foo do:

foo@sid:~$ pear download HTML_Common2
downloading HTML_Common2-2.1.1.tgz ...
Starting to download HTML_Common2-2.1.1.tgz (8,604 bytes)
.....done: 8,604 bytes
File /home/foo/HTML_Common2-2.1.1.tgz downloaded


then replace the cache files with symlinks (e.g. to files in home of
user bar, since he want's to try to globber these files). bar now is
unable to pear download HTML_Common2:

bar@sid:~$ pear download HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in /usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
download failed
bar@sid:~$ ls
bar@sid:~$

or as root

root@sid:~# pear download HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php
on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in
/usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
download failed
root@sid:~# pear install HTML_Common2

Notice: unserialize(): Error at offset 0 of 220 bytes in PEAR/REST.php
on line 203
PHP Notice:  unserialize(): Error at offset 0 of 220 bytes in
/usr/share/php/PEAR/REST.php on line 203
No releases available for package "pear.php.net/HTML_Common2"
install failed
root@sid:~#

So again, I don't think the issues with unsafe use of /tmp are fixed
correctly and the bugs should not be closed. PHP maintainers, what do
you think (Ondřej cc'ed)?

Regards,
Salvatore

#682157#44
Date:
2015-11-09 06:17:24 UTC
From:
To:
2015-11-08 7:25 GMT+01:00 Salvatore Bonaccorso <carnil@debian.org>:

Hi Salvatore,

I didn't want to close, it, but my Reply-to-all went to the -done addresses.

Which pear version are you testing?

Note that I'll be the php-pear maintainer, once the new package [1] is finished.

We should test against this latest 1.10 and report upstream is the bug remain.

[1]: anonscm.debian.org/cgit/pkg-php/php-pear.git

Regards

#682157#51
Date:
2015-11-14 18:18:52 UTC
From:
To:
Hi Mathieu,

Just to confirm, this was with php-pear provided from src:php5,
Version 5.6.14+dfsg-1.

Ack, yes I see.

Regards and thanks for your work there!

Salvatore