CVE-2012-1105

Name of the Vulnerable Software and Affected Versions Jasig Project php-pear-CAS version 1.2.2

Description An Information Disclosure issue exists in the Jasig Project php-pear-CAS package. The Central Authentication Service client library archives the debug logging file in an insecure manner in the /tmp directory.

Recommendations For Jasig Project php-pear-CAS version 1.2.2, consider restricting access to the debug logging file in the /tmp directory to minimize the risk of exploitation. As a temporary workaround, avoid using the debug logging feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.