CVE-2014-5459

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

Weakness

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name	Vendor	Start Version	End Version
Php	Php	*	5.6.0 (including)
Php-pear	Ubuntu	artful	*
Php-pear	Ubuntu	bionic	*
Php-pear	Ubuntu	cosmic	*
Php-pear	Ubuntu	disco	*
Php-pear	Ubuntu	eoan	*
Php-pear	Ubuntu	focal	*
Php-pear	Ubuntu	groovy	*
Php-pear	Ubuntu	hirsute	*
Php-pear	Ubuntu	impish	*
Php-pear	Ubuntu	kinetic	*
Php-pear	Ubuntu	lunar	*
Php-pear	Ubuntu	mantic	*
Php-pear	Ubuntu	oracular	*
Php-pear	Ubuntu	plucky	*
Php-pear	Ubuntu	xenial	*
Php-pear	Ubuntu	yakkety	*
Php-pear	Ubuntu	zesty	*
Php5	Ubuntu	lucid	*
Php5	Ubuntu	precise	*
Php5	Ubuntu	precise/esm	*
Php5	Ubuntu	trusty	*
Php5	Ubuntu	trusty/esm	*
Php5	Ubuntu	utopic	*
Php5	Ubuntu	vivid	*
Php5	Ubuntu	wily	*

Potential Mitigations

Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-5459
CWE	https://cwe.mitre.org/data/definitions/59.html

Improper Link Resolution Before File Access ('Link Following')

Weakness

Affected Software

Potential Mitigations

References

CVE-2014-5459

Improper Link Resolution Before File Access ('Link Following')

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References