Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

1. PHP is the "serious" or at least open-source/Linux/security freak's choice for web development. Mine as well (although as many still say, Perl does a better job).
While PHP is extremely popular, especially in open-source and Linux communities,I am not sure it qualifies as the defacto choice of "serious" web developers.
And I did not think it was as popular in the security community (when I occasionally scan one of the reports on the frequent PHP based applications
that grace this list, I thought exploit code is as often as not given in Perl:)

2. Developing secure applications in PHP is difficult, as one of PHP's creators said recently - even to him after years of trying.
The number of PHP applications getting reported on bugtraq would seem to
support this, although likely also contributed to the fact that it is popular,
and perhaps that it is (or at least has the reputation of being) of being easy to program, leading to programs written by people without understanding
of security implications.

My personal knowledge of PHP is somewhat meager, but having had to install
it recently for a developer I find the philosophy of the PHP security options
to be somewhat odd. It almost seemed like the emphasis was on distrusting
the programmer rather than the person running the program. I think it would
strongly benefit from the Perlish concept of data tainting.

3. Staying on top of new PHP vulnerabilities has become impossible, popping around everywhere.
While I concede I am less than happy about the frequency with which patched
versions of php come out, and most versions include some security related
patches, I do not think it is impossible. Furthermore, most of the "security"
patches have been rather localized, and affect only a small number of functions
and often only in rather specific circumstances, and with some knowledge of the
PHP applications running on your system you can often leap frog over some
of the versions.

Most bugtraq messages with PHP in the subject appear to be holes in specific applications, usually due to programming errors on the part of the application
author. This does not mean the language is inherently insecure; although it
may indicate that it is difficult to write secure PHP code. It could also
mean that PHP is easy enough to program that a lot of people without knowledge
of how to program securely are writing PHP code.

Tom Payerle Dept of Physics payerle@xxxxxxxxxxxxxxx
University of Maryland (301) 405-6973
College Park, MD 20742-4111 Fax: (301) 314-9525

Relevant Pages

  • TSLSA-2005-0059 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... use of Rest with FTP servers and Range with HTTP servers to retrieve files ... - New Upstream and Multiple Vendor Security Fixes ...
    (Bugtraq)
  • [NEWS] PHP Security Vulnerability in Multipart FORM Data Handling
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The PHP Group has learned of a serious security vulnerability in PHP ... code with the privileges of the web server. ...
    (Securiteam)
  • TSLSA-2007-0017 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... SECURITY Fix: Arnaud Giersch has reported a weakness in ELinks, ... The Common Vulnerabilities and Exposures project ...
    (Bugtraq)
  • Re: Securing an Email script
    ... request to our sales office. ... Since you do ZERO checking on the values it's nothing BUT security issues. ... very powerful PHP function to validate form fields and other strings - ...
    (comp.lang.php)
  • [Full-disclosure] [ GLSA 200511-08 ] PHP: Multiple vulnerabilities
    ... PHP suffers from multiple issues, resulting in security functions ... bypass, local Denial of service, cross-site scripting or PHP variables ...
    (Full-Disclosure)
Quantcast