Possible attack of a symbolic link

Every time I want to upgrade or install a PEAR package, I get the following sequence of error messages:

C:> pear update
Error receiving channel information from pear.php.net: SECURITY ERROR: will not be written to C: \ Users \ ALVARO.GONZALEZ \ AppData \ Local \ Temp \ pear \ cache \ 6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid, because it is symbolically associated with C: Users \ ALVARO.GONZALEZ \ AppData \ Local \ Temp \ pear \ cache \ 6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid - Possible attack of a symbolic link
[...]

What symbolic connection does this mean? When I copy and paste both paths and putting them side by side, I honestly don't see the difference:

C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cacheid 

The error will disappear when I omit the cache directory:

 C:\>pear clear-cache reading directory C:\Users\ALVARO.GONZALEZ\AppData\Local\Temp\pear\cache 74 cache entries cleared 

... until the next time I need to install the material.

My questions:

  • Why are these errors occurring?
  • Is there a way to prevent their occurrence in the first place?

Edit: There open a ticket about this filed at the end of 2011. The issue was caused by a security patch for Symlink attack in PEAR installation . I will report everything that comes out.

+6
source share
2 answers

The problem was a PEAR error:

The bug was fixed on PEAR 1.9.5 released on July 12, 2014.

+3
source

Delete all the contents of the pear \ cache directory in the user directory C: \ Users \ ALVARO.GONZALEZ \ AppData \ Local \ Temp \ pear \ cache \

Then you can make the installation of the pear

+2
source

All Articles