Welcome to Centmin Mod Community
Become a Member

Security Someone Hacked PHP PEAR Site and Replaced the Official Package Manager

Discussion in 'All Internet & Web Performance News' started by pamamolf, Jan 24, 2019.

  1. pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    1:56 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Beware! If you have downloaded PHP PEAR package manager from its official website in past 6 months, we are sorry to say that your server might have been compromised.

    Last week, the maintainers at PEAR took down the official website of the PEAR (pear-php.net) after they found that someone has replaced original PHP PEAR package manager (go-pear.phar) with a modified version in the core PEAR file system.

    Though the PEAR developers are still in the process of analyzing the malicious package, a security announcement published on January 19, 2019, confirmed that the allegedly hacked website had been serving the installation file contaminated with the malicious code to download for at least half a year.

    The PHP Extension and Application Repository (PEAR) is a community-driven framework and distribution system that offers anyone to search and download free libraries written in PHP programming language.

    These open-source libraries (better known as packages) allows developers to easily include additional functionalities into their projects and websites, including authentication, caching, encryption, web services, and many more.

    When you download PHP software for Unix/Linux/BSD systems, PEAR download manager (go-pear.phar) comes pre-installed, whereas Windows and Mac OS X users need to install the component when required manually.

    Since many web hosting companies, including shared hosting providers, also allow their users to install and run PEAR, this latest security breach could impact a large number of websites and their visitors.
    "If you have downloaded this go-pear.phar in the past six months, you should get a new copy of the same release version from GitHub (pear/pearweb_phars) and compare file hashes. If different, you may have the infected file," the note on the official PEAR website reads. According to the PEAR maintainers, the team is currently performing a forensic investigation to determine what is the extent of the attack and how the attackers managed to compromise the server in the first place.

    A new clean version 1.10.10 of pearweb_phars is now available on Github, which "re-releases the correct 'go-pear.phar' as v1.10.9, the file that was found tainted on the 'PEAR server is down' server, and now includes separate GPG signature files with each 'phar."

    The developers further notified that only the copy on the pear.php.net server was impacted, to their knowledge, and that the GitHub copy of go-pear.phar is not compromised.


    Since the PEAR officials have just put out a warning notification and not released any details about the security incident, it is still unclear that who is behind the attack.

    The developers tweeted that they will publish a "more detailed announcement" on the PEAR Blog once it's back online.

    All PHP/PEAR users who have downloaded the installation file go-pear.phar from the official website in the past six months should consider themselves compromised and quickly download and install the Github version.
     
  2. pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    1:56 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Does any Centminmod software/addon need that ?

    Any way to check if we are infected?
     
  3. Jimmy

    Jimmy Well-Known Member

    1,799
    391
    83
    Oct 24, 2015
    East Coast USA
    Ratings:
    +999
    Local Time:
    6:56 AM
    Looks like Pear is on my servers. Depending on where it's being downloaded from I guess would determine if we have the infected one or not.
     
  4. Jimmy

    Jimmy Well-Known Member

    1,799
    391
    83
    Oct 24, 2015
    East Coast USA
    Ratings:
    +999
    Local Time:
    6:56 AM
  5. Jimmy

    Jimmy Well-Known Member

    1,799
    391
    83
    Oct 24, 2015
    East Coast USA
    Ratings:
    +999
    Local Time:
    6:56 AM
    Quote is from the article I linked in my last post. My guess is that @eva2000 dloaded it from github. Which if that was the case, we'd all be ok. Of course, without looking at George's code, he might have a backup repo in-case github is down IDK.
     
  6. pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    1:56 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    It may be a good idea to block that ip even if it's a bit late ?

    Also there is a tool to check if a go-pear.phar file is an official one:

    Check if a go-pear.phar file is an official one
     
  7. pamamolf

    pamamolf Well-Known Member

    4,125
    429
    83
    May 31, 2014
    Ratings:
    +841
    Local Time:
    1:56 PM
    Nginx-1.29.x
    MariaDB 10.6.x
    Am i searching for it using the wrong way or i don't have it at all?

    Code:
    find / -name go-pear.phar
    Nothing found...
     
  8. Jimmy

    Jimmy Well-Known Member

    1,799
    391
    83
    Oct 24, 2015
    East Coast USA
    Ratings:
    +999
    Local Time:
    6:56 AM
    At this point, waiting for @eva2000 to comment would probably be best. He'll know what's up.
     
  9. eva2000

    eva2000 Administrator Staff Member

    58,908
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    8:56 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    It doesn't apply to Centmin Mod as PHP compiled uses the PHP packages' included pear source from php.net and not from pear download site at http://pear.php.net AFAIK.