Critical Object Injection Vulnerability in PEAR Archive_Tar Package
Summary
CVE-2018-1000888: PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. Affects php-pear versions < 1:1.10.6+submodules+notgz-1.1. Fixed in 1:1.10.6+submodules+notgz-1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PEAR Archive_Tar is a widely used PHP package that facilitates the creation and manipulation of tar archives. It provides a simple interface for developers to work with tar files, allowing for operations such as extraction and compression. However, versions 1.4.3 and earlier are susceptible to a serious vulnerability that can lead to unauthorized file operations and potential remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000888, arises from improper handling of user-supplied input in the Archive_Tar class. Specifically, the class performs file operations using the $v_header['filename'] parameter without adequate validation. This flaw allows an attacker to craft a malicious tar file that, when extracted, can trigger object injection through the unserialization of the Archive_Tar object. This can lead to arbitrary file deletion and, if exploited further, may result in remote code execution. The severity of this vulnerability is reflected in its CVSS score of 8.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
1:1.10.6+submodules+notgz-1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-pearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround involves restricting the use of the Archive_Tar class for untrusted tar files. Implement strict validation of input files and avoid extracting archives from untrusted sources. Additionally, consider using alternative libraries that do not have this vulnerability.
Conclusion
The CVE-2018-1000888 vulnerability in the PEAR Archive_Tar package poses significant risks, including potential remote code execution and arbitrary file deletion. It is crucial for users to upgrade to version 1.4.4 or later to mitigate these risks. For those unable to upgrade immediately, implementing strict validation and avoiding untrusted archives can serve as a temporary measure.
See every vulnerability recorded for php-pear →
FAQ
CVE-2018-1000888 is a security vulnerability in the PEAR Archive_Tar package that allows for object injection and potential remote code execution due to improper handling of user input.
Versions 1.4.3 and earlier of the PEAR Archive_Tar package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade, implement strict validation of input files and avoid extracting archives from untrusted sources as a temporary workaround.
The CVSS score of CVE-2018-1000888 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php-pear.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
