Mac OS X ships with security hole-laden PEAR - how to upgrade immediately

(26)

Do you develop a website? It is infinitely better to synchronize live and development sites using the PEAR Installer

(25)

doing the PEAR thing

(19)

Using PEAR 1.4.0 to install PEAR packages on a remote host

(19)

phpDocumentor and __get/__set/__call - give us your ideas (RFC)

(17)

Syndicate This Blog

RSS 0.91 feed

RSS 1.0 feed

RSS 2.0 feed

ATOM 0.3 feed

ATOM 1.0 feed

RSS 2.0 Comments

Powered by

Serendipity PHP Weblog

Wednesday, January 24. 2007

Mac OS X ships with security hole-laden PEAR - how to upgrade immediately

I was surprised to hear a colleague today ask how to upgrade from PEAR 1.3.6 to the latest 1.5.0, as the security holes in PEAR 1.3.6 and earlier have been pulbicly known for well over a year now. When I inquired as to why he was using PEAR 1.3.6, he explained that Max OS X ships with PEAR 1.3.6. I won't get into the questionable business practice of shipping software with known security holes that have had known fixes for years. Instead, I would like to offer simple step-by-step instructions of how to upgrade from outdated buggy PEAR versions to the latest stable release, 1.5.0.

pear upgrade Console_Getopt-1.2.1 Archive_Tar-1.3.1 PEAR-1.4.3
pear upgrade PEAR

These two commands will be sufficient to upgrade any system running PEAR 1.3.3 or newer. If you are running a REALLY outdated version of PEAR, you are far better off starting over from scratch using http://pear.php.net/go-pear, which should be downloaded and saved as go-pear.php, then run via:

php go-pear.php

These simple steps will allow any system to be upgraded. Note that if you're running something like version 1.3.0 of PEAR, you could risk running:

pear upgrade PEAR-1.3.6

and then try upgrading to PEAR using the 2 lines listed above. But for God's sake, don't stick with PEAR 1.3.6 or earlier, that is just asking for trouble.

Posted by Greg Beaver in PEAR at 21:35 | Comments (16) | Trackbacks (0)

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Hi Greg,

I upgraded Archive_Tar and Console_Getopt, but I'm running PEAR 1.3.2 - is there any way to upgrade directly to 1.3.3 (so that I can upgrade from there to 1.5.0)??

Thanks,

Fabian

#1 Fabian on 2007-01-26 06:59 (Reply)

Hi Fabian,

yes:

pear upgrade PEAR-1.3.3

#1.1 Greg Beaver (Homepage) on 2007-01-26 07:00 (Reply)

Hi Greg, any idea why I can't upgrade from pear 1.4.11 to 1.5? I'm getting error:

requires package `Structures_Graph' >= 1.0.2

If I try to install that, i get

No handlers for package.xml version 2.0

This is the same package.xml error I got trying to intall html_table, which was the original reason I tried to upgrade PEAR.

Any idea how to get out of this loop?

Jeff

#2 Jeff on 2007-01-26 13:24 (Reply)

Hi Jeff,

This is another common problem. I think you will be surprised to find that if you run

pear -V

it will display 1.3.6 instead of 1.4.11! This is due to the fact that you have more than one PEAR installation. if you type

which pear

and then (assuming it displays /usr/bin/pear)

cat /usr/bin/pear

note the include_path that it is setting. I guarantee it is not the one you think it is.

"No handlers for package.xml 2.0" is an error in pear 1.3.6 and earlier.

Once you find the actual PEAR you want to upgrade, it will do so smoothly.

Report back if you have more trouble

#2.1 Greg Beaver (Homepage) on 2007-01-26 15:54 (Reply)

Greg, many thanks for the prompt reply. I was able to get around my immediate problem by installing an older version of html_table that did not require package.xml 2.0.

But I went ahead and followed your instructions. I am running 1.3.2 as you suspected and would like to upgrade to avoid these errors in the future.

which pear says: /usr/local/bin/pear

when I cat that shell script, here's the part I'll need to change, but not sure how:

# then look for the right pear include dir
if test "x$PHP_PEAR_INSTALL_DIR" != "x"; then
INCDIR=$PHP_PEAR_INSTALL_DIR
INCARG="-d include_path=$PHP_PEAR_INSTALL_DIR"
else
if test "/usr/local/lib/php" = '@'php_dir'@'; then
INCDIR=`dirname $0`
INCARG=""
else
INCDIR="/usr/local/lib/php"
INCARG="-d include_path=/usr/local/lib/php"
fi
fi

---------

Could you advise how that should be fixed so it upgrades the right one? I don't have permissions on this server, will have to forward corrections to ISP.

#3 Jeff on 2007-01-29 12:43 (Reply)

I'm having the same trouble - am at 1.3.5 - but can't upgrade to 1.5 without Structures_Graph and can't do that because of the XML version 2.0 issue. IT's like a vicious circle, lol. I am hoping your reply to Jeff will solve my problem also.

#4 Mike on 2007-01-29 16:02 (Reply)

Jeff, Mike,

It occurs to me that replacements may have been broken in PEAR 1.3.x. Try

pear up -f PEAR-1.4.11
pear up PEAR

Let me know how that goes

#4.1 Greg Beaver (Homepage) on 2007-01-29 16:05 (Reply)

Greg - most excellent! the following worked fine for me:

pear upgrade -f PEAR-1.4.11
pear upgrade-all

Now I can get back to what I was originally working on.

Thank you very much!

regards,
Mike

#4.1.1 Mike on 2007-01-30 04:58 (Reply)

Thanks Greg, but it didn't work.

When I tried :pear up -f PEAR-1.4.11

I got this error:

Console_Getopt: unrecognized option -- f

any ideas?

ps fyi here's what's installed (though from what you say I guess it's not *really* what's installed). I removed the State column (all were 'stable') for readability:

Package Version
Archive_Tar 1.3.1
Auth 1.3.2
Console_Getopt 1.2.1
DB 1.7.6
HTML_Common 1.2.2
HTML_QuickForm 3.2.6
HTML_QuickForm_Controller 1.0.7
HTML_Table 1.6.0
HTML_Template_IT 1.2.1
PEAR 1.4.11
Structures_Graph 1.0
XML_Parser 1.2.8
XML_RPC 1.5.0

#5 Jeff on 2007-01-30 14:47 (Reply)

I just remembered - there was a bug in earlier PEAR versions where "pear up -f" would not work, however, if this is the cause, this will work:

pear upgrade --force PEAR-1.4.11

One thing to check:

pear config-get bin_dir

make sure it is /usr/local/bin since that is where the "pear" command was when you did "which pear"

If /usr/local/bin/pear is not where the pear script is, then use the same instructions to check bin_dir. To change bin_dr

pear config-set bin_dir /path/to/pearscript

or, in my example

pear config-set bin_dir /usr/local/bin

Try that out, and then:

pear upgrade --force PEAR-1.4.11

See if that works for you - we'll get this one yet! I plan to write up an official FAQ on this and put it on pear.php.net once I am sure we have all the contingencies worked out, so your reply is important.

#5.1 Gregory Beaver (Homepage) on 2007-01-30 15:06 (Reply)

Greg, many thanks (again), this seems to have worked.

Your assumption was correct, the bin_dir was not the same as the 'which pear' dir (edited to 'myclient' below):

%pear config-get bin_dir
bin_dir=/usr/home/myclient/pear/bin

So then I reset it and checked to make sure:

%pear config-set bin_dir /usr/local/bin
%pear config-get bin_dir
bin_dir=/usr/local/bin

And then this worked:

%pear upgrade --force PEAR-1.4.11

Only concern/question is that user i'm logged in as does not have write permissions in /usr/local/bin. So I'm not sure why this worked, and if there might be some security issues.

Now i'm intrigued by this

package `PEAR_Frontend_Web' version >= 0.5.0 is recommended to utilize some features.

I'm gonna have to spend some time checking that one out ...

Let me know if you want any more details, and thanks again for your assistance.

#6 Jeff on 2007-01-30 20:03 (Reply)

Don't worry about the Frontend_Web message, that is just letting you know that it is available, and also prevents you from using an earlier incompatible version if you already had it installed.

Glad we sorted the issues out, the contents of this blog entry should cover everyone's situation, now to craft a good FAQ from it...

#6.1 Greg Beaver (Homepage) on 2007-01-30 21:33 (Reply)

hi greg,

it seems you've helped a lot of people out here which is very kind of you. Its sounding like most people have problems settnig pear up.

I fortunatley have it set up on my mac. Ive done pear list as an adminsitrator and i get a list if some packages.

I need to install another on but am having serious problems. I have tried everything!
Basically i log in as the root user and cd to the folder that my .tar.gz of the package is. Then i go pear install thatpackage.tar.gz

all i get is xml_rpc_client: connection to the RPC server pear.php.net:80 failed. invalid argument.

Now i dont have access on my machine ( its a mac by the way!) and it seems to want to connect to the site it mentions.

any ideas on what my problem could be?

#7 james filtness on 2007-02-04 09:19 (Reply)

First of all, your example of a .tar.gz file is either too hypothetical, or you're installing a custom package which was NOT created using the "pear package" command. "pear package" only creates .tgz files.

Second, you need to follow the instructions listed on the front page of http://pear.php.net which are a condensed version of this blog post. Yes, you need internet access in order to upgrade PEAR.

Let me be even more clear: PEAR 1.4.x does not use XML-RPC. If you are getting xml_rpc_client errors, you are using PEAR 1.3.6 or older, and must upgrade.

#7.1 Greg Beaver (Homepage) on 2007-02-04 11:34 (Reply)

We appreciate all the work you do! And the upgrade to PEAR 1.5.0 was smooth. And honestly, I haven't visited the PEAR site for a while, so I didn't know of the update until I had to install some more packages. But thank you for everything that you do!

#8 Seth (Homepage) on 2007-03-01 17:04 (Reply)

I have a few problems with pear I have done the config-set bin-dir and now get

nameserver:~ admin$ pear config-get bin_dir
/usr/local/php5/bin/pear

but this on
nameserver:~ admin$ which pear
/usr/bin/pear

I want the /usr/local/php5/bin/pear to be my default package....
What did I do wrong ??

#9 Vincent on 2007-06-21 12:35 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Standard emoticons like :-) and ;-) are converted to images. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: BBCode format allowed You can use [geshi lang=lang_name [,ln={y\|n}]][/lang] tags to embed source code snippets
	Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.