#23179 [NEW]: PEAR.php and others are installed chmod 666 by default

From: Marius at LowVoice dot nl Operating system: debian linux PHP version: 4.3.1 PHP Bug Type: PEAR related Bug description: PEAR.php and others are installed chmod 666 by default I've found that on our systems files in PEAR (/usr/local/php/share/pear/*) have unsafe modes (666) basicaly this enables anyone on the system that has the ability to edit files to change the files to their liking. For instance the MAIL module of PEAR could easily be modified to send duplicates of all mail send by PEAR to their address. I've been able to reproduce this with a clean install of php4.3.1 that i've downloaded today. I think it's a pretty straitforward issue that doesn't require more info on the matter, however i'll be happy to be of more assistance if needed. Marius Karthaus Senior Systems Administrator LowVoice.com -- Edit bug report at http://bugs.php.net/?id=23179&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23179&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23179&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23179&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23179&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23179&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23179&r=support Expected behavior: http://bugs.php.net/fix.php?id=23179&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23179&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23179&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23179&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23179&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23179&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23179&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23179&r=gnused