Forgot your password?
typodupeerror
PHP Programming Bug Security

March To Be Month of PHP Bugs 292

Posted by kdawson
from the open-season dept.
PHP writes "Stefan Esser is the founder of both the Hardened-PHP Project and the PHP Security Response Team (which he recently left). During an interview with SecurityFocus he announced the upcoming Month of PHP bugs initiative in March." Quoting: "We will disclose different types of bugs, mainly buffer overflows or double free (/destruction) vulnerabilities, some only local, but some remotely triggerable... Additionally there are some trivial bypass vulnerabilities in PHP's own protection features... As a vulnerability reporter you feel kinda puzzled how people among the PHP Security Response Team can claim in public that they do not know about any security vulnerability in PHP, when you disclosed about 20 holes to them in the two weeks before. At this point you stop bothering whether anyone considers the disclosure of unreported vulnerabilities unethical. Additionally a few of the reported bugs have been known for years among the PHP developers and will most probably never be fixed. In total we have more than 31 bugs to disclose, and therefore there will be days when more than one vulnerability will be disclosed."
This discussion has been archived. No new comments can be posted.

March To Be Month of PHP Bugs

Comments Filter:
  • by Rastignac (1014569) on Tuesday February 20, 2007 @09:07AM (#18080450)
    Public Holes Publication, isn't it ? ;)
    • Re: (Score:2, Insightful)

      by Dimentox (678813)
      Actually PHP is not that insecure.. Its the people who do not know hjow to write code who are insecure. You blame PHP. I blame peole who actually think they can program but are nothing more but scripters. PHP can be secure. If you write it correctly. Think about the script kiddys who use automated perl scripts.. Should perl not be on systems? If you want real security unplug your machine.. it will be safe. Otherwise any machine can be vouln.
      • Re:So, PHP means ? (Score:5, Insightful)

        by Anonymous Coward on Tuesday February 20, 2007 @09:57AM (#18080802)
        No, PHP is quite insecure. The libraries, the interpreter, and most PHP software are all poorly written.

        And if inexperienced scripters is really the major problem, then the PHP developers need to take them into account when developing PHP. This means that the PHP developers need to add features to their product that help prevent such inexperienced people from writing easily-exploitable scripts. There has been some work done in this area, but it's been minimal, and so far ineffective.

        Yes, inexperienced developers probably are responsible for many of the problems. But the more experienced (I would hope) developers of PHP itself need to step up to the plate, and do their part to deal with the problem of inexperienced developers writing poor code. Even if they don't do it in order to offer a better product, they should do it to save the few remaining strands of their reputation.

        • Re: (Score:2, Interesting)

          by JoelMartinez (916445)

          And if inexperienced scripters is really the major problem, then the PHP developers need to take them into account when developing PHP. This means that the PHP developers need to add features to their product that help prevent such inexperienced people from writing easily-exploitable scripts.
          Microsoft calls this the pit of success ... where it's easy to "fall into" a successful implementation
      • by milamber3 (173273)

        Think about the script kiddys who use automated perl scripts.. Should perl not be on systems?
        You are confusing the ability to use a script written in a specific language to exploit a hole with security vulnerabilities that are inherent in a particular language.

        If you are making that mistake you should probably not be flaming anyone.
      • Re:So, PHP means ? (Score:5, Interesting)

        by daeg (828071) on Tuesday February 20, 2007 @10:25AM (#18081062)
        The problem isn't just the coders, it's the fault of the language, too. Sure, you can write fairly secure PHP code, but the language itself does not lend itself to teaching security. It's plainly evident that most features have "ease of use" ahead of "security" -- Register Globals is a prime example. I could have told you from the start that registering variables based on the names of POST/GET values was a Bad Idea(tm). Hell, anyone could have.

        PHP is also forever afraid of breaking backwards compatibility. They probably don't want to scare PHP coders.

        They also have issues around the monolithic nature of PHP. Oh, you want image processing? Recompile PHP! Oh, you need XML processing? Recompile PHP! There is no isolation whatsoever, everything resides in the same namespace.

        I am glad that they are making progress, though. PHP 5 finally brought their OO up to speed (mostly). They finally have a secure, native database connector (PDO) that supports escaped bound parameters. PHP 6 is finally removing some deprecated features.

        That said, I still am weary when I log into a website that holds my personal information and see a ".php" URL.

        (I was a full time PHP developer for about 6 years. Was.)
        • Re: (Score:2, Informative)

          by onerob (976438)
          Register Globals has been off by default for years.

          Please don't let us see the return of \'magic quotes\'
          • by julesh (229690)
            Register Globals has been off by default for years.

            Yes, but most hosting companies just switch it straight back on again, to stem the tide of complaints from users who downloaded an old script from somewhere but it doesn't work...
            • by Kelson (129150) *

              Yes, but most hosting companies just switch it straight back on again, to stem the tide of complaints from users who downloaded an old script from somewhere but it doesn't work...

              I was going to gripe about it being an issue for the hosting companies (we've had it disabled on our servers for several years), but now that I think about it, you're right: Register Globals is a "wings fall off" button.

          • Re: (Score:3, Funny)

            by daeg (828071)
            Don't you mean \\\\\\\\\'magic quotes\\\\\\\\\'?
        • You've just summed up--in one short comment--everything I hate about PHP. I've been a PHP developer for several years and it was my first introduction to the OSS community, but I still remember that wild discovery: "You mean have to take down the entire service just because it wasn't compiled against this or that library? That's INSANE! What the hell is Linux FOR?"
          • You've just summed up--in one short comment--everything I hate about PHP. I've been a PHP developer for several years and it was my first introduction to the OSS community, but I still remember that wild discovery: "You mean have to take down the entire service just because it wasn't compiled against this or that library? That's INSANE! What the hell is Linux FOR?"

            I understand the point you're making, but why don't you just run it in CGI mode if you don't want to recompile, or use dl() to load the exten

          • by Kelson (129150) *

            "You mean have to take down the entire service just because it wasn't compiled against this or that library? That's INSANE! What the hell is Linux FOR?"

            Really? Leaving aside the matter of using shared libraries, whenever I've had to add features to PHP it's gone like this:

            1. Configure PHP with new options
            2. Rebuild PHP
            3. Reinstall PHP
            4. service httpd configtest
            5. service httpd restart

            The only actual downtime occurs during step 5, which lasts maybe a second at most. This is Linux after all -- you can run the

        • by yem (170316)

          Warning

          If your application does not catch the exception thrown from the PDO constructor, the default action taken by the zend engine is to terminate the script and display a back trace. This back trace will likely reveal the full database connection details, including the username and password. It is your responsibility to catch this exception, either explicitly (via a catch statement) or implicitly via set_exception_handler().

          The default behavior in case of database problems is to display the host, u

      • Re: (Score:3, Interesting)

        by tinkertim (918832) *

        Actually PHP is not that insecure.. Its the people who do not know hjow to write code who are insecure. You blame PHP. I blame peole who actually think they can program but are nothing more but scripters. PHP can be secure. If you write it correctly. Think about the script kiddys who use automated perl scripts.. Should perl not be on systems? If you want real security unplug your machine.. it will be safe. Otherwise any machine can be vouln.

        You are correct, but that doesn't make net irritants that are permi

        • Give people a day or two to respond to each exploit before he hands us another to go racing after.
          • by tinkertim (918832) *

            Give people a day or two to respond to each exploit before he hands us another to go racing after.


            Especially us poor bastards that have 500 + servers to patch. I'm sure (err, hope?) they will do it responsibly , however I still see this being a *very* interesting month.

            • I've long argued that for as much as the pro-PHP group blames the coders, there is simply no excuse for some of the levels of vulnerability. So, while I'm loathe for the torrent of problems, I am glad to see someone finally calling PHP out in the open for some of the problems it created long before any kid touched a single line of code.
      • by Joebert (946227)
        That speach sounds soo scripted.
      • by tepples (727027)

        PHP can be secure. If you write it correctly.
        Except in PHP 4 and PHP 5, the content of php.ini as deployed by too many shared hosting companies has not necessarily been conducive to writing it correctly.
  • great... (Score:5, Informative)

    by blantonl (784786) on Tuesday February 20, 2007 @09:09AM (#18080460) Homepage
    Looks like this will also be "Month-of-me-working-harder-to-make-sure-my-site-i s-patched- and-updated-and-not-exploited-by-script-kiddies"

    • Re: (Score:2, Funny)

      by julesh (229690)
      Yep. This is going to be fun^Wannoying.
    • Re:great... (Score:4, Insightful)

      by FredDC (1048502) on Tuesday February 20, 2007 @09:13AM (#18080500)
      As opposed to "month-of-script-kiddies-working-hard-to-exploit-n on-patched-and-non-updated-websites"?
      • Re: (Score:3, Funny)

        by Joebert (946227)
        Hi kids! Would you like to script this? (Yeah yeah yeah!)
        Wanna see me shoot chocolate milk from each one of my eyelids? (Uh-huh!)
        Wanna copy this and paste exactly like I did? (Yeah yeah!)
        Try the wrong CID and get fucked up worse that my code is? (Huh?)
        My mouse's dead weight, I'm tryin to get my story straight
        but I can't figure out which Administrator I want to impersonate (Ummmm..)
        And Dr. Phil said, "Failure is no accident."
        Uh-huhhh! "Then why's your hands red? Man you busted!"
        Well at age twelve, I
    • Re: (Score:2, Insightful)

      by bconway (63464) *
      Well, to be fair, you did choose to use PHP, which is notoriously buggy and insecure.
    • Re: (Score:3, Insightful)

      by kestasjk (933987) *
      I'm a PHP enthusiast with a few servers running PHP apps, and I say bring it on. If such a small team can look for and find so many bugs I doubt a determined attacker would have much problem anyway.
      I'm sure that after the dust has settled PHP will be more secure than it was, and that can only be a good thing.
      • by mobby_6kl (668092)

        I'm sure that after the dust has settled PHP will be more secure than it was ...

        That's like saying that the ocean will be more wet after it's been raining for a day than it was before.
        • by mobby_6kl (668092)
          Disregard that post, I should have previewed and read it again before submitting. It actually makes it sound like PHP is the OpenBSD of scripting languages, which is obviously the opposite of the desired effect.
          • by lymond01 (314120)
            Your posts are like the Edgar J. Hoover of Broadway theatre.

            Arr? (Scooby-doo head tilt)
    • Re: (Score:3, Informative)

      by miyako (632510)
      This comment reflects what seems to be one of the biggest misconceptions in computer security. People seem to be under the impression that vulnrabilities are magically conjured into existance when the bugs are made public.
      The fact is that the bugs have really been there the whole time, and just because we didn't know about it doesn't mean that some nefarious person didn't know about it.
      Now, script kiddies might not know about the vulnrabilities until they are made public, but they are called script kiddi
      • by julesh (229690)
        This comment reflects what seems to be one of the biggest misconceptions in computer security. People seem to be under the impression that vulnrabilities are magically conjured into existance when the bugs are made public.

        Well, yes, but the fact is that there is incalculably higher risk from an unpatched, publicised bug (especially if more than a few weeks old) than there is in an unpublicised one. Almost all exploits occur using well known bugs, even if you discount worms.
    • Re:great... (Score:4, Funny)

      by elrous0 (869638) * on Tuesday February 20, 2007 @09:57AM (#18080800)
      Hey, my un-fashionable use of Perl finally pays off!

      [Ducks down and hopes next month isn't the "31 days of Perl Bugs"]

      -Eric

    • The bright side, it seems to me, is that PHP's openness means even if the developers are slack, the bugs can still be disclosed without IP litigation threats.

      Also, he's given the developers a week or two of warning before March. If there's anything *that* serious in there, actually known to the developers, the fix could conceivably be ready by the time the bug is announced.

      I run PHP sites, and I'd rather see the bugs public and being patched, than known only to the developers (we hope).
    • Looks like this will also be "Month-of-me-working-harder-to-make-sure-my-site- i s-patched- and-updated-and-not-exploited-by-script-kiddies"

      Well, if the article is to be believed and the PHP team hasn't much cared about some of these bugs, patching and updating won't help you. In any event, these bugs won't be fixed live. So they will result in potential compromise you won't be able to stop, likely.

      In other words, this will also be "Month-of-you-getting-bent-over-by-open-security-h oles-in-PHP-you-can'

    • by suv4x4 (956391)
      Looks like this will also be "Month-of-me-working-harder-to-make-sure-my-site- i s-patched- and-updated-and-not-exploited-by-script-kiddies"

      You can thank the PHP internals and Zend about this. Having to deal with them at some points, they are literally like having to handle a bunch of spoiled children on a mission to have fun on your expense.

      I've said it plenty of times and I'll say it again: PHP is going down, fast. The only reason to use it right now, is because there's still some money to be made from cl
      • by rho (6063)

        (Much) faster, more stable and more consistent alternatives currently include Mono (C# - an excellent language), Python, Java and possibly Ruby 2.0, from the looks of it.

        I hear this a lot. PHP has a massive installed base of working apps. There is no compelling reason to move to a new language simply because it appears to be more secure at the expense of not having functional applications.

        • Re: (Score:3, Interesting)

          by jZnat (793348) *

          There is no compelling reason to move to a new operating system simply because it appears to be more secure at the expense of not having functional applications.
          Notice the similarities when you replace "language" with "operating system". :O
  • Huh (Score:5, Funny)

    by Anonymous Coward on Tuesday February 20, 2007 @09:10AM (#18080470)
    I thought every month was PHP Bugs month?
  • even if... (Score:3, Insightful)

    by cosmocain (1060326) on Tuesday February 20, 2007 @09:12AM (#18080488)
    ...there are that much holes in PHP (which i don't doubt), mr. esser seems to be on a kind of crusade since he left the security response team.
    • Re:even if... (Score:5, Informative)

      by Alphager (957739) <florianhaas@@@fsfe...org> on Tuesday February 20, 2007 @09:26AM (#18080572) Homepage Journal
      He began his crusade when he founded the security-team: He wants a secure PHP. He left the security-team out of frustration that the main devs didn't care about security (leaving security-critical bugs unfixed for ages). This month of PHP-bugs is his effort to put pressure on the devs to finally make security a priority.
  • by Anonymous Coward on Tuesday February 20, 2007 @09:12AM (#18080494)
    month of PCP bugs. i see them all over my skin and i can't scratch them off! SOMEONE HELP ME
  • by Anonymous Coward on Tuesday February 20, 2007 @09:15AM (#18080512)

    I really shouldn't be surprised at the PHP team's approach to security any more, but it really does still surprise me from time to time. It's amazing, but the PHP team are worse than Microsoft ever were with security. And they don't even learn from this - they've had this attitude for as long as I can remember (PHP 3 days), and they just aren't getting it. Or rather, if they get it, they just don't care.

    • by Anonymous Coward on Tuesday February 20, 2007 @09:38AM (#18080652)
      It's amazing, but the PHP team are worse than Microsoft ever were with security.

      This is very true. And also very unfortunate. When it comes to many managers, PHP has given the entire open source community a bad name. This is mainly because it has been repeatedly pushed as being part of the LAMP suite, when in fact Python and Perl are far better options for the 'P'. So when you recommend the use of Linux, Apache or MySQL, they automatically think of PHP, and recall how terrible its security is. And then they associate that lack of security with Linux, Apache and MySQL, even when that's not the case!

      If there's one thing the open source community as a whole should do, it should be to disown PHP. Responsible open source developers and projects need to just stop using it for their web sites. It'd be good if more things like this Month of PHP Bugs were held, just to show the public that the OSS community knows that PHP is terrible, and wants to do something about it. The longer we continue to use PHP, the harder it will be to repair the reputation of even completely unrelated (and far more secure) open source projects.

      • by archen (447353) on Tuesday February 20, 2007 @11:29AM (#18081864)
        The problem with PHP is that it's very easy. One of the supposed advantages of Lamp is that it is also rather easy to set up and work with. I've seen more projects than I would care to, where the programmers couldn't code their way out of a paper bag but managed to accumulate a surprisingly functional mass of PHP spaghetti code. Perl is a good option only if the coders are disciplined, and having good structure is critical for a good Perl project. I don't have any experience with Python, but due to the nature of python language structure, you'll never be able to embed it the way you could with PHP (templates are necessary here as well).

        One of the problems with PHP is the fact that when the bar of entry is so low, you get a lot more low bar people actually coding it. It's become the next generation of VB garbage. The language is only half of the security problem (a half we could better do without, but still).
    • Re: (Score:3, Interesting)

      by julesh (229690)
      I really shouldn't be surprised at the PHP team's approach to security any more, but it really does still surprise me from time to time. It's amazing, but the PHP team are worse than Microsoft ever were with security. And they don't even learn from this - they've had this attitude for as long as I can remember (PHP 3 days), and they just aren't getting it. Or rather, if they get it, they just don't care.

      I'm not surprised. Their attitude to bug reports in general is pretty hostile. See, for instance, this [php.net]
  • For once (Score:5, Insightful)

    by Timesprout (579035) on Tuesday February 20, 2007 @09:15AM (#18080514)
    I am actually glad to see one of these xxx month of bugs. Personally I have always thought PHP to be a steaming pile of poorly thought out garbage but there is no denying its popularity despite its flaws. Anything that actually helps the meme 'most php flaws are caused by poor programmers' actually become a reality by improving the core security of the language is therefore to be welcomed.
    • Re: (Score:3, Insightful)

      by jimicus (737525)
      Anything that actually helps the meme 'most php flaws are caused by poor programmers' actually become a reality

      Most flaws in any code are caused by poor programmers. It's possible to write clearly structured, well laid out code in BASIC (no, not visual BASIC, the real thing), as most implementations support things like local variables and procedures. It's just exceptionally rare.

      This is why so many computer science degrees (at least until recently in the UK) used Modula-2 or Pascal as their primary teachi
    • Re: (Score:3, Insightful)

      by rho (6063)

      Personally I have always thought PHP to be a steaming pile of poorly thought out garbage but there is no denying its popularity despite its flaws.

      A critical thinker will look at those two clauses and derive some wisdom. PHP is not "poorly thought out", it changes to meet the market's needs. Java was very well thought out, but it's mostly popular with big shops where you can hire a guy for $70,000/year to maintain a tiny little bit of a larger program. PHP is very popular because it allows a single person

      • by drinkypoo (153816)

        PHP is very popular because it allows a single person (or a small group) to make functional applications quickly and easily, with a lot of flexibility.

        So does ASP. In fact, ASP is easier in a lot of ways, and has MORE flexibility (supports any ISAPI language, including vbscript (yuck), perl (whee), php (hello month of bugs!), python, blah blah blah.

        PHP is popular because it's free and Free and lets one person write a very simple/stupid dynamic webpage very easily. Unfortunately, it seems that when you get

  • Install modsecurity (Score:5, Informative)

    by HxBro (98275) on Tuesday February 20, 2007 @09:20AM (#18080532) Homepage
    I recently installed modsecurity http://www.modsecurity.org/ [modsecurity.org] for apache along with the rules from http://www.gotroot.com/ [gotroot.com] and it's done a good job of blocking attacks on my server including a lot of the php mail() injection attempts, whilst it has shown up a few false positives like someone posting a message with sql keywords e.g. "select" "from", it is certainly worth installing even if you have to monitor the logs for a bit afterwards to watch for the false positives and alter the rules accordingly.

    Whilst it probably won't solve a lot of the problems with php and security it does help protect the server especially when you don't have control over what your users are uploading to their web space.
  • by cerelib (903469) on Tuesday February 20, 2007 @09:36AM (#18080634)
    I always had the feeling that the bad security reputation with PHP had less to do with technical bugs and more to do with how easy it is to write insecure code(especially when using the mysql module). Also at fault is the general lack of programming understanding by the amatuers who find their way to PHP because it is so easy to go from having a static HTML page to a dynamic PHP page. Are there a lot of vulnerabilities in the interpreter?
    • by CodeShark (17400)
      Poor code writing and a failure to integrate known fixes is the problem. For example, code/modules developed by the Hardened PHP project referenced earlier has fixes many of the known vulnerabilities, and in general PHP 5.X is much more secure than prior versions.

      Personally while I don't necessarily like all the work I have to do when there is a "bug exposure" in the media for tools I am using -- like PHP -- I don't have time to track everything let alone fix them, this "month of bugs" won't affect me as m

    • Re: (Score:3, Insightful)

      by poot_rootbeer (188613)
      I always had the feeling that the bad security reputation with PHP had less to do with technical bugs and more to do with how easy it is to write insecure code

      Or even more likely, how easy it is to download and run insecure code written by some other lousy programmer. It's not the people who are writing their own CMS systems that are getting haxor'd, it's the people who grabbed a copy of PHPNuke and threw it up there on the 'net.
  • Wait... (Score:5, Funny)

    by kahei (466208) on Tuesday February 20, 2007 @09:39AM (#18080662) Homepage

    Only a month?

    Ha ha, yes, thank you, I'll be here all week, bringing predictable yet mildly amusing banter. In fact, I'll be here all year. The whole of my life, probably. *breaks down and cries*

  • by MikeRT (947531) on Tuesday February 20, 2007 @09:44AM (#18080690) Homepage
    If he really wants to make a difference, he should fork PHP and really fix up the language and interpreter to his liking. Besides bug and security fixes, a standard naming convention for built-in functions would be quite nice. Maybe Esser could do for PHP what EGCS did for GCCS if he did that.
    • Re: (Score:3, Insightful)

      by julesh (229690)
      If he really wants to make a difference, he should fork PHP and really fix up the language and interpreter to his liking.

      Err... he has [hardened-php.org].

      Sometimes I think people don't read the articles.

      Then I remember I'm reading slashdot.
  • by bill_mcgonigle (4333) * on Tuesday February 20, 2007 @10:52AM (#18081400) Homepage Journal
    "Month of Shooting Fish In a Barrel"

    At least the Month of Apple Bugs was a hard target to go after.
  • by corychristison (951993) on Tuesday February 20, 2007 @11:32AM (#18081890)
    I've been running PHP for some time now, I try to use the latest and greatest, but sometimes I am a little behind.

    Here are a few simple precautions for PHP configuration:
    • Do not(!) install cURL. I know it is useful, but has a lot of security problems!
    • Disable register globals [default as of 4.2.0]
    • Safemode is worthless and a little too restricting, use OpenBaseDir.
    • disable_functions = exec,system,passthru,shell_exec,proc_open,proc_clo se,proc_terminate,proc_nice,proc_get_status (may be more, off the top of my head :-)
    These are what I can think of off the top of my head. This allows full compatability with all major scripts [mostly due to not using SafeMode] but still holds a fair bit of protection from people executing scripts and pushing them to run in the background. Had this happen to me a few years ago. I was hosting someone as a favour, and I'm not sure if they did it, or they were running some crappy code and it was exploited. Either way, their account was suspended.
  • I'm going to need enough popcorn to last... March.
  • If you teach a man to fish with a rod, he won't immediately know a better way to catch more fish. The idea of using a mesh net to catch more fish at once will not be apparent to him -- it will take time. A man and his tools are departed only when he finds something better for the job.

    So let's apply this concept to learning in the PHP community. For years, PHP developers (newbies, amateurs, and experts alike) have been handed down wisdom that reflected the current knowledge. Years ago, it was using regist
  • by DigitAl56K (805623) on Tuesday February 20, 2007 @12:44PM (#18082868)
    "At this point you stop bothering whether anyone considers the disclosure of unreported vulnerabilities unethical."

    Maybe. But to take more than 31 bugs and disclose them a day at a time so that in effect major web-facing infrastructure for big business and home users alike will have no chance at all of being secured during this entire window, all for the purposes of publicity?

The reason why worry kills more people than work is that more people worry than work.

Working...