Bug 1133753 (CVE-2014-5459)

Summary:	CVE-2014-5459 php-pear: insecure temporary file use for cache data
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, jorton, jrusnack, mmaslano, rcollet, rpm, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-20 17:38:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1133754
Bug Blocks:	1133755

Description Murray McAllister 2014-08-26 04:45:46 UTC

It was reported that the pear utility insecurely used the /tmp/ directory for cache data. A local attacker could use this flaw to perform a symbolic link attack against a user (typically the root user) running a pear command, causing an arbitrary file to be overwritten, possibly leading to a denial of service.

Original report:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282

Comment 1 Murray McAllister 2014-08-26 04:47:13 UTC

Created php-pear tracking bugs for this issue:

Affects: fedora-all [bug 1133754]

Comment 2 Murray McAllister 2014-08-26 04:53:00 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/08/26/3

Comment 3 Remi Collet 2014-08-26 05:24:24 UTC

# pear config-get cache_dir
/var/cache/php-pear

# ll -d /var/cache/php-pear
drwxr-xr-x. 2 root root 147456 22 août  08:57 /var/cache/php-pear


So /tmp is not used with default provided configuration.

So, I think we are not affected by this debian specific issue.

Comment 4 Murray McAllister 2014-08-27 06:53:45 UTC

(In reply to Remi Collet from comment #3)
> # pear config-get cache_dir
> /var/cache/php-pear
> 
> # ll -d /var/cache/php-pear
> drwxr-xr-x. 2 root root 147456 22 août  08:57 /var/cache/php-pear
> 
> 
> So /tmp is not used with default provided configuration.
> 
> So, I think we are not affected by this debian specific issue.

Thanks Remi, sorry for not checking that.

MITRE assigned CVE-2014-5459 to this issue:

http://www.openwall.com/lists/oss-security/2014/08/27/3

Comment 6 Vincent Danen 2015-01-20 17:38:09 UTC

Statement:

This issue did not affect the versions of php-pear as shipped with Red Hat Enterprise Linux 5, 6 and 7 as well as Red Hat Software Collections as they do not use a world-writable directory for storing PEAR cache data.