Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

March To Be Month of PHP Bugs

Posted by kdawson on Tue Feb 20, 2007 09:04 AM
from the open-season dept.
PHP Programming Bug Security
PHP writes "Stefan Esser is the founder of both the Hardened-PHP Project and the PHP Security Response Team (which he recently left). During an interview with SecurityFocus he announced the upcoming Month of PHP bugs initiative in March." Quoting: "We will disclose different types of bugs, mainly buffer overflows or double free (/destruction) vulnerabilities, some only local, but some remotely triggerable... Additionally there are some trivial bypass vulnerabilities in PHP's own protection features... As a vulnerability reporter you feel kinda puzzled how people among the PHP Security Response Team can claim in public that they do not know about any security vulnerability in PHP, when you disclosed about 20 holes to them in the two weeks before. At this point you stop bothering whether anyone considers the disclosure of unreported vulnerabilities unethical. Additionally a few of the reported bugs have been known for years among the PHP developers and will most probably never be fixed. In total we have more than 31 bugs to disclose, and therefore there will be days when more than one vulnerability will be disclosed."
+ -
story

Related Stories

[+] PHP Security Expert Resigns 386 comments
juct writes "PHP security holes have a name — quite often it was Stefan Esser who found and reported them. Now Esser has quit the PHP security team. He feels that his attempt to make PHP safer "from the inside" is futile. Basic security issues are not addressed sufficiently by the developers. Zeev Suraski, Zend's CTO of course disagrees and urges Stefan to work with the PHP development team instead of working against it. But given the number of remote code execution holes in PHP apps this year, Esser might have a point. And he plans to continue his quest for security holes in PHP. Only that from now on, he will publish them after reasonable time — regardless if a patch is available or not." Update: 10/30 12:57 GMT by KD : Zeev Suraski wrote in to protest: "I'm quoted as if I 'point fingers at inexperienced developers,' and of course, there's no link to that — because it's not true! The two issues — security problems in Web apps written in PHP, and security problems in PHP itself — are two distinct issues. Nobody, including myself, is saying that there are no security problems in PHP — not unlike pretty much any other piece of software. Nobody, I think, argues the fact that there have been many more security problems at the application level, then there were at the language level. I never replied to Stefan's accusations of security problems in PHP saying 'that's bull, it's all the developers' fault,' and I have no intention to do it in the future."
[+] Month of PHP Bugs Has Begun 165 comments
An anonymous reader writes "The previously announced Month of PHP Bugs started three days ago, and already lists 8 security vulnerabilities in PHP and PHP related software. From the site: 'This initiative is an effort to improve the security of PHP. However we will not concentrate on problems in the PHP language that might result in insecure PHP applications, but on security vulnerabilities in the PHP core. During March 2007 old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day by day basis. We will also point out necessary changes in the current vulnerability management process used by the PHP Security Response Team.'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

March To Be Month of PHP Bugs 25 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • So, PHP means ? (Score:4, Funny)

    by Rastignac (1014569) on Tuesday February 20 2007, @09:07AM (#18080450)
    Public Holes Publication, isn't it ? ;)

      • Re:So, PHP means ? (Score:5, Insightful)

        by Anonymous Coward on Tuesday February 20 2007, @09:57AM (#18080802)
        No, PHP is quite insecure. The libraries, the interpreter, and most PHP software are all poorly written.

        And if inexperienced scripters is really the major problem, then the PHP developers need to take them into account when developing PHP. This means that the PHP developers need to add features to their product that help prevent such inexperienced people from writing easily-exploitable scripts. There has been some work done in this area, but it's been minimal, and so far ineffective.

        Yes, inexperienced developers probably are responsible for many of the problems. But the more experienced (I would hope) developers of PHP itself need to step up to the plate, and do their part to deal with the problem of inexperienced developers writing poor code. Even if they don't do it in order to offer a better product, they should do it to save the few remaining strands of their reputation.

              • Re:Pot calling the kettle black (Score:4, Interesting)

                by julesh (229690) on Tuesday February 20 2007, @03:57PM (#18086356)
                If you're a programmer and you don't see huge problems with both the design of PHP itself and the standard library you should just quit now and find another hobby/profession.

                I'm a programmer. I work with PHP. I see a hell of a lot of problems with its design and implementation. Am I ready to dump it and switch to something better? You bet. I've been waiting for the chance for the last 5 years or more.

                Can I actually do this?

                No. The marketplace is such that if I implement my solutions in any other environment, I'm cutting myself out of large chunks of the market simply because people might choose a hosting provider that doesn't support whatever alternative language I choose to use.

      • Re:So, PHP means ? (Score:5, Interesting)

        by daeg (828071) on Tuesday February 20 2007, @10:25AM (#18081062)
        The problem isn't just the coders, it's the fault of the language, too. Sure, you can write fairly secure PHP code, but the language itself does not lend itself to teaching security. It's plainly evident that most features have "ease of use" ahead of "security" -- Register Globals is a prime example. I could have told you from the start that registering variables based on the names of POST/GET values was a Bad Idea(tm). Hell, anyone could have.

        PHP is also forever afraid of breaking backwards compatibility. They probably don't want to scare PHP coders.

        They also have issues around the monolithic nature of PHP. Oh, you want image processing? Recompile PHP! Oh, you need XML processing? Recompile PHP! There is no isolation whatsoever, everything resides in the same namespace.

        I am glad that they are making progress, though. PHP 5 finally brought their OO up to speed (mostly). They finally have a secure, native database connector (PDO) that supports escaped bound parameters. PHP 6 is finally removing some deprecated features.

        That said, I still am weary when I log into a website that holds my personal information and see a ".php" URL.

        (I was a full time PHP developer for about 6 years. Was.)

  • great... (Score:5, Informative)

    by blantonl (784786) on Tuesday February 20 2007, @09:09AM (#18080460) Homepage
    Looks like this will also be "Month-of-me-working-harder-to-make-sure-my-site-i s-patched- and-updated-and-not-exploited-by-script-kiddies"

    • Re:great... (Score:4, Insightful)

      by FredDC (1048502) on Tuesday February 20 2007, @09:13AM (#18080500)
      As opposed to "month-of-script-kiddies-working-hard-to-exploit-n on-patched-and-non-updated-websites"?

    • Re: (Score:3, Insightful)

      by kestasjk (933987) *
      I'm a PHP enthusiast with a few servers running PHP apps, and I say bring it on. If such a small team can look for and find so many bugs I doubt a determined attacker would have much problem anyway.
      I'm sure that after the dust has settled PHP will be more secure than it was, and that can only be a good thing.

    • Re: (Score:3, Informative)

      by miyako (632510)
      This comment reflects what seems to be one of the biggest misconceptions in computer security. People seem to be under the impression that vulnrabilities are magically conjured into existance when the bugs are made public.
      The fact is that the bugs have really been there the whole time, and just because we didn't know about it doesn't mean that some nefarious person didn't know about it.
      Now, script kiddies might not know about the vulnrabilities until they are made public, but they are called script kiddi

    • Re:great... (Score:4, Funny)

      by elrous0 (869638) * on Tuesday February 20 2007, @09:57AM (#18080800)
      Hey, my un-fashionable use of Perl finally pays off!

      [Ducks down and hopes next month isn't the "31 days of Perl Bugs"]

      -Eric

  • Huh (Score:5, Funny)

    by Anonymous Coward on Tuesday February 20 2007, @09:10AM (#18080470)
    I thought every month was PHP Bugs month?

  • even if... (Score:3, Insightful)

    by cosmocain (1060326) on Tuesday February 20 2007, @09:12AM (#18080488)
    ...there are that much holes in PHP (which i don't doubt), mr. esser seems to be on a kind of crusade since he left the security response team.

  • i suggest for next month (Score:3, Funny)

    by Anonymous Coward on Tuesday February 20 2007, @09:12AM (#18080494)
    month of PCP bugs. i see them all over my skin and i can't scratch them off! SOMEONE HELP ME

  • Partially surprising (Score:5, Insightful)

    by Anonymous Coward on Tuesday February 20 2007, @09:15AM (#18080512)

    I really shouldn't be surprised at the PHP team's approach to security any more, but it really does still surprise me from time to time. It's amazing, but the PHP team are worse than Microsoft ever were with security. And they don't even learn from this - they've had this attitude for as long as I can remember (PHP 3 days), and they just aren't getting it. Or rather, if they get it, they just don't care.

    • PHP is a disgrace to the open source community. (Score:5, Interesting)

      by Anonymous Coward on Tuesday February 20 2007, @09:38AM (#18080652)
      It's amazing, but the PHP team are worse than Microsoft ever were with security.

      This is very true. And also very unfortunate. When it comes to many managers, PHP has given the entire open source community a bad name. This is mainly because it has been repeatedly pushed as being part of the LAMP suite, when in fact Python and Perl are far better options for the 'P'. So when you recommend the use of Linux, Apache or MySQL, they automatically think of PHP, and recall how terrible its security is. And then they associate that lack of security with Linux, Apache and MySQL, even when that's not the case!

      If there's one thing the open source community as a whole should do, it should be to disown PHP. Responsible open source developers and projects need to just stop using it for their web sites. It'd be good if more things like this Month of PHP Bugs were held, just to show the public that the OSS community knows that PHP is terrible, and wants to do something about it. The longer we continue to use PHP, the harder it will be to repair the reputation of even completely unrelated (and far more secure) open source projects.

      • Re:PHP is a disgrace to the open source community. (Score:4, Insightful)

        by archen (447353) on Tuesday February 20 2007, @11:29AM (#18081864)
        The problem with PHP is that it's very easy. One of the supposed advantages of Lamp is that it is also rather easy to set up and work with. I've seen more projects than I would care to, where the programmers couldn't code their way out of a paper bag but managed to accumulate a surprisingly functional mass of PHP spaghetti code. Perl is a good option only if the coders are disciplined, and having good structure is critical for a good Perl project. I don't have any experience with Python, but due to the nature of python language structure, you'll never be able to embed it the way you could with PHP (templates are necessary here as well).

        One of the problems with PHP is the fact that when the bar of entry is so low, you get a lot more low bar people actually coding it. It's become the next generation of VB garbage. The language is only half of the security problem (a half we could better do without, but still).

  • For once (Score:5, Insightful)

    by Timesprout (579035) on Tuesday February 20 2007, @09:15AM (#18080514)
    I am actually glad to see one of these xxx month of bugs. Personally I have always thought PHP to be a steaming pile of poorly thought out garbage but there is no denying its popularity despite its flaws. Anything that actually helps the meme 'most php flaws are caused by poor programmers' actually become a reality by improving the core security of the language is therefore to be welcomed.

    • Re: (Score:3, Insightful)

      by jimicus (737525)
      Anything that actually helps the meme 'most php flaws are caused by poor programmers' actually become a reality

      Most flaws in any code are caused by poor programmers. It's possible to write clearly structured, well laid out code in BASIC (no, not visual BASIC, the real thing), as most implementations support things like local variables and procedures. It's just exceptionally rare.

      This is why so many computer science degrees (at least until recently in the UK) used Modula-2 or Pascal as their primary teachi

  • Install modsecurity (Score:5, Informative)

    by HxBro (98275) on Tuesday February 20 2007, @09:20AM (#18080532) Homepage
    I recently installed modsecurity http://www.modsecurity.org/ [modsecurity.org] for apache along with the rules from http://www.gotroot.com/ [gotroot.com] and it's done a good job of blocking attacks on my server including a lot of the php mail() injection attempts, whilst it has shown up a few false positives like someone posting a message with sql keywords e.g. "select" "from", it is certainly worth installing even if you have to monitor the logs for a bit afterwards to watch for the false positives and alter the rules accordingly.

    Whilst it probably won't solve a lot of the problems with php and security it does help protect the server especially when you don't have control over what your users are uploading to their web space.

  • Are bugs the problem? (Score:5, Interesting)

    by cerelib (903469) on Tuesday February 20 2007, @09:36AM (#18080634)
    I always had the feeling that the bad security reputation with PHP had less to do with technical bugs and more to do with how easy it is to write insecure code(especially when using the mysql module). Also at fault is the general lack of programming understanding by the amatuers who find their way to PHP because it is so easy to go from having a static HTML page to a dynamic PHP page. Are there a lot of vulnerabilities in the interpreter?

  • Wait... (Score:5, Funny)

    by kahei (466208) on Tuesday February 20 2007, @09:39AM (#18080662) Homepage

    Only a month?

    Ha ha, yes, thank you, I'll be here all week, bringing predictable yet mildly amusing banter. In fact, I'll be here all year. The whole of my life, probably. *breaks down and cries*

  • PHP needs to be fixed in general (Score:3, Informative)

    by MikeRT (947531) on Tuesday February 20 2007, @09:44AM (#18080690) Homepage
    If he really wants to make a difference, he should fork PHP and really fix up the language and interpreter to his liking. Besides bug and security fixes, a standard naming convention for built-in functions would be quite nice. Maybe Esser could do for PHP what EGCS did for GCCS if he did that.

  • Coming in April (Score:5, Funny)

    by bill_mcgonigle (4333) * on Tuesday February 20 2007, @10:52AM (#18081400) Homepage Journal
    "Month of Shooting Fish In a Barrel"

    At least the Month of Apple Bugs was a hard target to go after.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.