Vulnerability Name:

CVE-2005-4154 (CCN-23021)

Assigned:2005-11-07
Published:2005-11-07
Updated:2020-01-23
Summary:Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitrary code via a crafted package that can execute code when the pear command is executed or when the Web/Gtk frontend is loaded.
CVSS v3 Severity:5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2005-4154

Source: CCN
Type: PEAR Web site
PEAR :: The PHP Extension and Application Repository

Source: CCN
Type: PEAR SECURITY VULNERABILITY ANNOUNCEMENT November 4, 2005
PEAR installer arbitrary code execution vulnerability

Source: CONFIRM
Type: Patch, Vendor Advisory
http://pear.php.net/advisory-20051104.txt

Source: CCN
Type: SA17563
PEAR Installer Arbitrary Code Execution Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
17563

Source: SECTRACK
Type: Patch
1015161

Source: CCN
Type: SECTRACK ID: 1015161
PEAR Installer Lets Remote Users Execute Arbitrary Code in Certain Cases

Source: CCN
Type: OSVDB ID: 20856
PEAR Installer Crafted Package Arbitrary Command Execution

Source: VUPEN
Type: Vendor Advisory
ADV-2005-2444

Source: XF
Type: UNKNOWN
pear-installer-code-execution(23021)

Source: XF
Type: UNKNOWN
pear-installer-code-execution(23021)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:pear:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.11:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.90:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:*:*:*:*:*:*:*:* (Version <= 1.4.2)

    • Configuration CCN 1:
  • cpe:/a:php:pear:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.11:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:0.90:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0:b1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0:b2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.0:b3:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:b1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:b2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:b3:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:b4:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.2:b5:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:b1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:b2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:b3:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:b5:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.3:b6:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a1:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a10:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a11:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a12:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a2:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a3:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a4:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a5:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a6:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a7:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a8:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.0:a9:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:php:pear:1.4.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    php pear 0.9
    php pear 0.10
    php pear 0.11
    php pear 0.90
    php pear 1.0
    php pear 1.0.1
    php pear 1.1
    php pear 1.2
    php pear 1.2.1
    php pear 1.3
    php pear 1.3.1
    php pear 1.3.3
    php pear 1.3.3.1
    php pear 1.3.4
    php pear 1.3.5
    php pear 1.3.6
    php pear 1.4.0
    php pear 1.4.0 rc1
    php pear 1.4.0 rc2
    php pear 1.4.1
    php pear *
    php pear 0.10
    php pear 0.11
    php pear 0.9
    php pear 0.90
    php pear 1.0
    php pear 1.0.1
    php pear 1.0b1
    php pear 1.0b2
    php pear 1.0b3
    php pear 1.1
    php pear 1.2
    php pear 1.2.1
    php pear 1.2b1
    php pear 1.2b2
    php pear 1.2b3
    php pear 1.2b4
    php pear 1.2b5
    php pear 1.3
    php pear 1.3.1
    php pear 1.3.3
    php pear 1.3.3.1
    php pear 1.3.4
    php pear 1.3.5
    php pear 1.3.6
    php pear 1.3b1
    php pear 1.3b2
    php pear 1.3b3
    php pear 1.3b5
    php pear 1.3b6
    php pear 1.4.0
    php pear 1.4.0 rc1
    php pear 1.4.0 rc2
    php pear 1.4.0a1
    php pear 1.4.0a10
    php pear 1.4.0a11
    php pear 1.4.0a12
    php pear 1.4.0a2
    php pear 1.4.0a3
    php pear 1.4.0a4
    php pear 1.4.0a5
    php pear 1.4.0a6
    php pear 1.4.0a7
    php pear 1.4.0a8
    php pear 1.4.0a9
    php pear 1.4.1
    php pear 1.4.2