lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 1 Jan 2007 10:53:39 -0700 (MST)
From: Bill Nash <billn@...ln.net>
To: Kevin Waterson <kevin@...ania.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

On Sun, 31 Dec 2006, Kevin Waterson wrote:

> This one time, at band camp, Gadi Evron <ge@...uxbox.org> wrote:
> 
> >
> > Indeed, the most annoying thing about the PHP worms today is that these 
> > PHP vulnerabilities being exploited are everywhere.
> 
> These are not PHP vulnerabilities, these are application vulnerabilities.
>  

	I agree. Unless this thread is focusing on vulnerabilities in the 
PHP parser itself, exploitable simply by pushing arbitrary information 
through any available post/get channel, then I think we can call it a PHP 
vulnerability. Until then, let's keep the FUD to a minimum.

	*ANY* language implemented for *ANY* purpose is as secure as the 
programmer makes it. The way the original post is written, 
s/PHP/(Perl|ASP|C|bash|BASIC|four little buddhist monks fighting over an 
abacus)/ is applicable. The vulnerabilities that we see, that Gadi refers 
to, aren't widespread because PHP is widespread, but because insecure 
applications written in PHP are. A better use of energy would be 
focusing on the most vulnerable platforms and educating the developers.

- billn

Powered by blists - more mailing lists