Slashdot Log In
March To Be Month of PHP Bugs
Posted by
kdawson
on Tue Feb 20, 2007 08:04 AM
from the open-season dept.
from the open-season dept.
PHP writes "Stefan Esser is the founder of both the Hardened-PHP Project and the PHP Security Response Team (which he recently left). During an interview with SecurityFocus he announced the upcoming Month of PHP bugs initiative in March." Quoting: "We will disclose different types of bugs, mainly buffer overflows or double free (/destruction) vulnerabilities, some only local, but some remotely triggerable... Additionally there are some trivial bypass vulnerabilities in PHP's own protection features... As a vulnerability reporter you feel kinda puzzled how people among the PHP Security Response Team can claim in public that they do not know about any security vulnerability in PHP, when you disclosed about 20 holes to them in the two weeks before. At this point you stop bothering whether anyone considers the disclosure of unreported vulnerabilities unethical. Additionally a few of the reported bugs have been known for years among the PHP developers and will most probably never be fixed. In total we have more than 31 bugs to disclose, and therefore there will be days when more than one vulnerability will be disclosed."
Related Stories
[+]
PHP Security Expert Resigns 386 comments
juct writes "PHP security holes have a name — quite often it was Stefan Esser who found and reported them. Now Esser has quit the PHP security team. He feels that his attempt to make PHP safer "from the inside" is futile. Basic security issues are not addressed sufficiently by the developers. Zeev Suraski, Zend's CTO of course disagrees and urges Stefan to work with the PHP development team instead of working against it. But given the number of remote code execution holes in PHP apps this year, Esser might have a point. And he plans to continue his quest for security holes in PHP. Only that from now on, he will publish them after reasonable time — regardless if a patch is available or not."
Update: 10/30 12:57 GMT by KD : Zeev Suraski wrote in to protest: "I'm quoted as if I 'point fingers at inexperienced developers,' and of course, there's no link to that — because it's not true! The two issues — security problems in Web apps written in PHP, and security problems in PHP itself — are two distinct issues. Nobody, including myself, is saying that there are no security problems in PHP — not unlike pretty much any other piece of software. Nobody, I think, argues the fact that there have been many more security problems at the application level, then there were at the language level. I never replied to Stefan's accusations of security problems in PHP saying 'that's bull, it's all the developers' fault,' and I have no intention to do it in the future."
[+]
Month of PHP Bugs Has Begun 165 comments
An anonymous reader writes "The previously announced Month of PHP Bugs started three days ago, and already lists 8 security vulnerabilities in PHP and PHP related software. From the site: 'This initiative is an effort to improve the security of PHP. However we will not concentrate on problems in the PHP language that might result in insecure PHP applications, but on security vulnerabilities in the PHP core. During March 2007 old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day by day basis. We will also point out necessary changes in the current vulnerability management process used by the PHP Security Response Team.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So, PHP means ? (Score:4, Funny)
Re: (Score:2, Insightful)
Re:So, PHP means ? (Score:5, Insightful)
And if inexperienced scripters is really the major problem, then the PHP developers need to take them into account when developing PHP. This means that the PHP developers need to add features to their product that help prevent such inexperienced people from writing easily-exploitable scripts. There has been some work done in this area, but it's been minimal, and so far ineffective.
Yes, inexperienced developers probably are responsible for many of the problems. But the more experienced (I would hope) developers of PHP itself need to step up to the plate, and do their part to deal with the problem of inexperienced developers writing poor code. Even if they don't do it in order to offer a better product, they should do it to save the few remaining strands of their reputation.
Parent
Re:Pot calling the kettle black (Score:4, Interesting)
I'm a programmer. I work with PHP. I see a hell of a lot of problems with its design and implementation. Am I ready to dump it and switch to something better? You bet. I've been waiting for the chance for the last 5 years or more.
Can I actually do this?
No. The marketplace is such that if I implement my solutions in any other environment, I'm cutting myself out of large chunks of the market simply because people might choose a hosting provider that doesn't support whatever alternative language I choose to use.
Parent
Re:So, PHP means ? (Score:5, Interesting)
PHP is also forever afraid of breaking backwards compatibility. They probably don't want to scare PHP coders.
They also have issues around the monolithic nature of PHP. Oh, you want image processing? Recompile PHP! Oh, you need XML processing? Recompile PHP! There is no isolation whatsoever, everything resides in the same namespace.
I am glad that they are making progress, though. PHP 5 finally brought their OO up to speed (mostly). They finally have a secure, native database connector (PDO) that supports escaped bound parameters. PHP 6 is finally removing some deprecated features.
That said, I still am weary when I log into a website that holds my personal information and see a ".php" URL.
(I was a full time PHP developer for about 6 years. Was.)
Parent
From the PDO docs page: (Score:3, Informative)
The default behavior in case of database problems is to display the host, u
Take down the service? (Score:3, Insightful)
Really? Leaving aside the matter of using shared libraries, whenever I've had to add features to PHP it's gone like this:
The only actual downtime occurs during step 5, which lasts maybe a second at most. This is Linux after all -- you can run the
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
You are correct, but that doesn't make net irritants that are permi
great... (Score:5, Informative)
Re: (Score:2, Funny)
Re:great... (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
Wanna see me shoot chocolate milk from each one of my eyelids? (Uh-huh!)
Wanna copy this and paste exactly like I did? (Yeah yeah!)
Try the wrong CID and get fucked up worse that my code is? (Huh?)
My mouse's dead weight, I'm tryin to get my story straight
but I can't figure out which Administrator I want to impersonate (Ummmm..)
And Dr. Phil said, "Failure is no accident."
Uh-huhhh! "Then why's your hands red? Man you busted!"
Well at age twelve, I
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
In the case of SQL injection attacks, definitely yes. They provide add_slashes(), oh, but wait, that's insecure, so they provided mysql_escape_string() instead. Oh wait, that's insecure too, so they provided mysql_real_escape_string() instead. All the while, ignoring the fact that string concatenation is prone to security problems by its very natu
Re: (Score:3, Interesting)
There are many reasons that add_slashes is insecure, and if you think about it, you should be able to come up with a few yourself. Have you ever heard of Unicode? Do you really know what the quoting conventions of your database are, or are you just assuming that add_slashes somehow magically does? Have you even bothered to use google or read any of the many security articles about PHP? Obviously not. And the same goes for so many other PHP developers. They need training wheels and adult supervision, otherw
Re: (Score:3, Insightful)
I'm sure that after the dust has settled PHP will be more secure than it was, and that can only be a good thing.
Re: (Score:3, Informative)
The fact is that the bugs have really been there the whole time, and just because we didn't know about it doesn't mean that some nefarious person didn't know about it.
Now, script kiddies might not know about the vulnrabilities until they are made public, but they are called script kiddi
Re:great... (Score:4, Funny)
[Ducks down and hopes next month isn't the "31 days of Perl Bugs"]
-Eric
Parent
Look on the open/bright side. (Score:3, Informative)
Also, he's given the developers a week or two of warning before March. If there's anything *that* serious in there, actually known to the developers, the fix could conceivably be ready by the time the bug is announced.
I run PHP sites, and I'd rather see the bugs public and being patched, than known only to the developers (we hope).
Re: (Score:2)
I actually persuaded my business partner to authorise a 2-month long project to reimplement all the features we need from phpBB from scratch, rather than use original code, just for this reason. It didn't take much work to convince him that we didn't want the hassle of having to deal with regular [netcraft.com] 0-day [netcraft.com] exploit [astahost.com] sc
Re: (Score:3, Interesting)
Huh (Score:5, Funny)
even if... (Score:3, Insightful)
Re:even if... (Score:5, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Maybe what he cared more about was security, not the language.
Re:even if... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Hear, hear. (Score:4, Insightful)
Parent
i suggest for next month (Score:3, Funny)
Partially surprising (Score:5, Insightful)
I really shouldn't be surprised at the PHP team's approach to security any more, but it really does still surprise me from time to time. It's amazing, but the PHP team are worse than Microsoft ever were with security. And they don't even learn from this - they've had this attitude for as long as I can remember (PHP 3 days), and they just aren't getting it. Or rather, if they get it, they just don't care.
PHP is a disgrace to the open source community. (Score:5, Interesting)
This is very true. And also very unfortunate. When it comes to many managers, PHP has given the entire open source community a bad name. This is mainly because it has been repeatedly pushed as being part of the LAMP suite, when in fact Python and Perl are far better options for the 'P'. So when you recommend the use of Linux, Apache or MySQL, they automatically think of PHP, and recall how terrible its security is. And then they associate that lack of security with Linux, Apache and MySQL, even when that's not the case!
If there's one thing the open source community as a whole should do, it should be to disown PHP. Responsible open source developers and projects need to just stop using it for their web sites. It'd be good if more things like this Month of PHP Bugs were held, just to show the public that the OSS community knows that PHP is terrible, and wants to do something about it. The longer we continue to use PHP, the harder it will be to repair the reputation of even completely unrelated (and far more secure) open source projects.
Parent
Re:PHP is a disgrace to the open source community. (Score:4, Insightful)
One of the problems with PHP is the fact that when the bar of entry is so low, you get a lot more low bar people actually coding it. It's become the next generation of VB garbage. The language is only half of the security problem (a half we could better do without, but still).
Parent
Re: (Score:3, Interesting)
I'm not surprised. Their attitude to bug reports in general is pretty hostile. See, for instance, this [php.net]
For once (Score:5, Insightful)
Re: (Score:3, Insightful)
Most flaws in any code are caused by poor programmers. It's possible to write clearly structured, well laid out code in BASIC (no, not visual BASIC, the real thing), as most implementations support things like local variables and procedures. It's just exceptionally rare.
This is why so many computer science degrees (at least until recently in the UK) used Modula-2 or Pascal as their primary teachi
Re: (Score:3, Insightful)
Personally I have always thought PHP to be a steaming pile of poorly thought out garbage but there is no denying its popularity despite its flaws.
A critical thinker will look at those two clauses and derive some wisdom. PHP is not "poorly thought out", it changes to meet the market's needs. Java was very well thought out, but it's mostly popular with big shops where you can hire a guy for $70,000/year to maintain a tiny little bit of a larger program. PHP is very popular because it allows a single person
Install modsecurity (Score:5, Informative)
Whilst it probably won't solve a lot of the problems with php and security it does help protect the server especially when you don't have control over what your users are uploading to their web space.
Are bugs the problem? (Score:5, Interesting)
Re: (Score:3, Insightful)
Or even more likely, how easy it is to download and run insecure code written by some other lousy programmer. It's not the people who are writing their own CMS systems that are getting haxor'd, it's the people who grabbed a copy of PHPNuke and threw it up there on the 'net.
Wait... (Score:5, Funny)
Only a month?
Ha ha, yes, thank you, I'll be here all week, bringing predictable yet mildly amusing banter. In fact, I'll be here all year. The whole of my life, probably. *breaks down and cries*
PHP needs to be fixed in general (Score:3, Informative)
Re: (Score:3, Insightful)
Err... he has [hardened-php.org].
Sometimes I think people don't read the articles.
Then I remember I'm reading slashdot.
Coming in April (Score:5, Funny)
At least the Month of Apple Bugs was a hard target to go after.
A Couple Easy Precautions (Score:3, Informative)
Here are a few simple precautions for PHP configuration:
- Do not(!) install cURL. I know it is useful, but has a lot of security problems!
- Disable register globals [default as of 4.2.0]
- Safemode is worthless and a little too restricting, use OpenBaseDir.
- disable_functions = exec,system,passthru,shell_exec,proc_open,proc_cl
o se,proc_terminate,proc_nice,proc_get_status (may be more, off the top of my head :-)
These are what I can think of off the top of my head. This allows full compatability with all major scripts [mostly due to not using SafeMode] but still holds a fair bit of protection from people executing scripts and pushing them to run in the background. Had this happen to me a few years ago. I was hosting someone as a favour, and I'm not sure if they did it, or they were running some crappy code and it was exploited. Either way, their account was suspended.Yes, this _is_ unethical (Score:3, Interesting)
Maybe. But to take more than 31 bugs and disclose them a day at a time so that in effect major web-facing infrastructure for big business and home users alike will have no chance at all of being secured during this entire window, all for the purposes of publicity?
Re: (Score:2, Informative)
There are a handful [cakephp.org] of decent [xisc.com] PHP frameworks [symfony-project.com] out there, with others coming along [zend.com], which you can take and compare with Django, but