CVE-2006-0868: PEAR::Auth potential authentication bypass vulnerability
Summary
CVE-2006-0868: PEAR::Auth potential authentication bypass vulnerability. Affects pear/auth across 2 version ranges.
< 1.2.4
>= 1.3.0r1, < 1.3.0r4
Fixed in 1.2.4 or 1.3.0r4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PEAR::Auth is a package in the Packagist ecosystem that provides authentication functionality for PHP applications. It offers various back ends for storing and managing authentication credentials. This vulnerability affects versions before 1.2.4 and 1.3.x before 1.3.0r4 of PEAR::Auth. The underlying storage containers in these versions are susceptible to multiple unspecified injection vulnerabilities, which can be exploited by remote attackers to falsify authentication credentials.
Vulnerability Detail
The vulnerability arises from unspecified injection vulnerabilities in the Auth Container back ends of PEAR::Auth. These vulnerabilities allow remote attackers to manipulate the underlying storage containers, leading to the falsification of authentication credentials. The exact nature and impact of these injection vulnerabilities are not specified in the available information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.2.41.2.4composer require pear/auth:1.2.4 -
>= 1.3.0r1, < 1.3.0r41.3.0r4composer require pear/auth:1.3.0r4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is mentioned in the available information. It is advised to follow the recommended fix and upgrade to the fixed versions of PEAR::Auth.
Conclusion
The PEAR::Auth package is vulnerable to potential authentication bypass due to unspecified injection vulnerabilities in its Auth Container back ends. Upgrading to the fixed versions, 1.2.4 or 1.3.0r4, is crucial to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pear/auth →
FAQ
PEAR::Auth is a package in the Packagist ecosystem that provides authentication functionality for PHP applications.
Versions before 1.2.4 and 1.3.x before 1.3.0r4 of PEAR::Auth are affected.
The vulnerability allows remote attackers to falsify authentication credentials by exploiting injection vulnerabilities in the Auth Container back ends.
To fix this vulnerability, upgrade to version 1.2.4 if using a version before that. For versions 1.3.x before 1.3.0r4, upgrade to version 1.3.0r4.
No specific workaround is mentioned. It is recommended to upgrade to the fixed versions of PEAR::Auth.
