CVE-2020-28949: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
A flaw was found in the ArchiveTar package. PEAR ArchiveTar could allow a local authenticated attacker to bypass security restrictions caused by a stream-wrapper attack. An attacker can overwrite arbitrary files on the system using a specially-crafted tar archive.
Other sources
ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
PEAR ArchiveTar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
— CISA
Potential file overwrite if archive filename starts with file://
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/php-pearto a version that resolves this vulnerability.Fixed in 1:1.9.4-23.el7_9 - Upgrade
Upgrade
debian/php-pearto a version that resolves this vulnerability.Fixed in 1:1.10.12+submodules+notgz+20210212-1Fixed in 1:1.10.13+submodules+notgz+2022032202-2 - Upgrade
Upgrade
redhat/Archive_Tarto a version that resolves this vulnerability.Fixed in 1.4.11 - Upgrade
Upgrade
Archive_Tar (PEAR)to a version that resolves this vulnerability.Fixed in 1.4.10 - Configuration
When processing tar archives with Archive_Tar, ensure filename sanitization blocks stream-wrapper prefixes beyond phar: (the material notes that through 1.4.10 only phar: is handled while file:// can still be used to overwrite arbitrary files).
Archive_Tar (PEAR) tar archive filename handling (stream-wrapper support) = Block/deny any use of stream-wrapper prefixes such as file:// (not only phar:) - Compensating control
Restrict or avoid processing tar archives from untrusted sources; require trust/authentication and validate archive filenames to prevent stream-wrapper-based overwrite (e.g., file:// leading to potential overwrite).
- Operational
Review for any files that may have been overwritten via crafted tar archives (especially where archive filenames start with file://) and remediate as needed.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-28949?
CVE-2020-28949 is a vulnerability in PEAR Archive_Tar that allows an unserialization attack due to blocking the phar: protocol but not the PHAR: protocol.
What is PEAR Archive_Tar?
PEAR Archive_Tar is an open-source framework and distribution system for reusable PHP components.
How does CVE-2020-28949 affect me?
CVE-2020-28949 affects you if you are using the affected versions of PEAR Archive_Tar, PHP-PEAR, Drupal, or specific Linux distributions.
What is the severity of CVE-2020-28949?
CVE-2020-28949 has a severity of high, with a CVSS score of 7.1.
How can I mitigate CVE-2020-28949?
To mitigate CVE-2020-28949, update PEAR Archive_Tar, PHP-PEAR, Drupal, or the affected Linux distributions to the recommended versions.