#36483 [NEW]: phpize php_autoconf security fix

From: david at davidfavor dot com Operating system: RedHat EL-4 PHP version: 5.1.2 PHP Bug Type: Feature/Change Request Bug description: phpize php_autoconf security fix Description: ------------ Since I've only installed PHP the first time, please route this the the correct place. There are many reports that resemble this: /usr/local/bin/phpize: /tmp/tmpEcSnL3/apd-1.0.1/build/shtool: /bin/sh: bad interpreter: Permission denied Cannot find autoconf. Please check your autoconf installation and the $PHP_AUTOCONF environment variable is set correctly and then rerun this script. ERROR: `phpize' failed The problem is the pear command seems to be be violate usual security precautions. That is mounting /tmp with the noexec option disallows the execution of /tmp/*/shtool. The fix seems to be maybe checking the executability of scripts on /tmp first and prompting the user for an alternative directory first. The ugly work around is to change /etc/fstab to allow /tmp files to be executed... Shudder... Reproduce code: --------------- 1) In /etc/fstab: /dev/hda3 /tmp ext3 defaults,noexec 1 0 2) reboot 3) pear install pecl/pdflib -- Edit bug report at http://bugs.php.net/?id=36483&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=36483&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=36483&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=36483&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=36483&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=36483&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=36483&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=36483&r=needscript Try newer version: http://bugs.php.net/fix.php?id=36483&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=36483&r=support Expected behavior: http://bugs.php.net/fix.php?id=36483&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=36483&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=36483&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=36483&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=36483&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=36483&r=dst IIS Stability: http://bugs.php.net/fix.php?id=36483&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=36483&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=36483&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=36483&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=36483&r=mysqlcfg