RSS   Vulnerabilities for 'Pear archive tar'   RSS

2018-12-28
 
CVE-2018-1000888

CWE-502
 

 
PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.

 

 >>> Vendor: PHP 24 Products
PHP
Php fi
Phpsquidpass
PEAR
Comoblog
Php script index
Directory listing script
Animated smiley generator
Errordocs
Phorum
Blog cms
Ar memberscript
BLOQ
Com extensions
Mysql extension
Mysql banner exchange
F1 maxs file uploader
Xhprof
Php perl hot links
Pecl http
Pear archive tar
Imagick
Ext-http
Archive tar


Copyright 2021, cxsecurity.com

 

Back to Top