Every time I want to upgrade or install a PEAR package, I get the following sequence of error messages:
C:> pear update
Error receiving channel information from pear.php.net: SECURITY ERROR: will not be written to C: \ Users \ ALVARO.GONZALEZ \ AppData \ Local \ Temp \ pear \ cache \ 6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid, because it is symbolically associated with C: Users \ ALVARO.GONZALEZ \ AppData \ Local \ Temp \ pear \ cache \ 6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid - Possible attack of a symbolic link
[...]
What symbolic connection does this mean? When I copy and paste both paths and putting them side by side, I honestly don't see the difference:
C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid
The error will disappear when I omit the cache directory:
C:\>pear clear-cache reading directory C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache 74 cache entries cleared
... until the next time I need to install the material.
My questions:
- Why are these errors occurring?
- Is there a way to prevent their occurrence in the first place?
Edit: There open a ticket about this filed at the end of 2011. The issue was caused by a security patch for Symlink attack in PEAR installation . I will report everything that comes out.
source share