CVE-2011-1144: Low severity php pear vulnerability
The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) downloaddir, (2) cachedir, (3) tmpdir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1144?
The severity of CVE-2011-1144 is categorized as a moderate vulnerability due to its ability to allow local users to exploit the system through symlink attacks.
How do I fix CVE-2011-1144?
To fix CVE-2011-1144, upgrade to a version of PEAR later than 1.9.2, where the symlink vulnerability has been addressed.
What are the impacts of CVE-2011-1144?
The impacts of CVE-2011-1144 include potential file overwriting by local users, which can lead to unauthorized data modification or system compromise.
Who is affected by CVE-2011-1144?
CVE-2011-1144 affects users of PEAR versions 1.9.2 and earlier, particularly those with local system access.
Is there a workaround for CVE-2011-1144?
A workaround for CVE-2011-1144 is to restrict local user access to the PEAR installation directories to mitigate the risk of symlink attacks.