Secunia.com: Avaya Products PHP Multiple Vulnerabilities
2961
Secunia has posted a vulnerability marked as "highly critical" for users of any of the Avaya products that use PHP:   Avaya has acknowledged some vulnerabilities in various Avaya products, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions and potentially by malicious people to compromise a vulnerable system.   The following products are affected:   Avaya Communication Manager (CM 4.0 and CM 2.x prior to load 127.0) Avaya CCS/SES (CCS/SES 3.1.1) Avaya AES (AES 4.0)   Currently, according to the original announcement from Avaya, there are two issues that have been found and are able to be exploited - an issue with the xmlrpc extension and a problem with the ftp extension. Currently, there is no patch to correct these issues, but you can keep track of their current status via their entries
517744
A vulnerability that McAfee Avert Labs first warned about last week is now being exploited in the wild, according to VeriSign&#39;s iDefense. At issue are embedded objects in Rich Text Format (RTF) files.
289622
According to this new advisory from Secunia today, the SuSE linux group has released a new package update for the PHP4 distribution on their operating system:   SUSE has issued an update for php4. This fixes some vulnerabilities and a weakness, where one has an unknown impact and the others can be exploited by malicious, local users to gain escalated privileges, and by malicious, local users and malicious people to bypass certain security restrictions.   The issue is marked as "Less critical" but it's still a good idea to update, especially when it relates to security issues. You can find more information at the original advisory on the Novell site.
679178
In this new advisory posted on the Secunia.com site today, there's an announcement of a highly critical update for Ubuntu users for their PHP distributions.   Ubuntu has issued an update for php. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions and potentially by malicious people to compromise a vulnerable system.   Check out the posting to grab the links for the packages for the various distributions (and for the different version numbers of Ubuntu). As this issue is marked as "highly critical" it's recommended that you update your installation as soon as possible.
193310
Here's what was popular in the PHP community one year ago today:onPHP5.com: Clickable, Obfuscated Email AddressesJacob Santos' Blog: PHP BlackjackThe Bakery: RESTful Web Services With CakePHPDeveloper.com: Developing a Ajax-driven Shopping Cart with PHP and PrototypeGreg Beaver's Blog: Mac OS X ships with security hole-laden PEAR - how to upgrade immediatelyNexen.net: English Articles and a Single Distribution ResourceJob Posting: Red Ventures Seeks Several LAMP Developers (Charlotte, NC)The Bakery: Checking for duplicate records (unique record)DevShed: The Basics of Abstract Factory Classes in PHP 5NewsForge.com: A DIY calendar control in PHPDevGuide.net: Dynamic Bitmap Graphics with PHP and GDRichard Heyes' Blog: Browser DetectionInternational PHP Magazine: Poll Question: Which is the Most Important Feature of PHP 5?Builder.au: Dynamic XML document construction with the PHP DOMCommunity News: PEAR Version 1.5.0 Released
228808
Stefan Esser points out a new patch today - CORE GRASP - from the Core Security Technologies group that provides taint support surrounding the mysql_query function.   Their implementation adds a tainted or not flag for every byte so that it is possible on invocation of mysql_query() to determine any kind of injection.   Unfortunately, Stefan also mentions two big issues it might have from the get-go: the overhead for the memory needed can slow things down and an incorrect parsing in their query handler could lead to injection attacks.
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
411252
As posted on Secunia.com today, the SuSE linux distribution has release updates to both their PHP4 and PHP5 packages today:   SUSE has issued an update for php4 and php5. This fixes some vulnerabilities, where one has an unknown impact and others can be exploited by malicious, local users to bypass certain security restrictions and gain escalated privileges, and by malicious people to to cause a DoS (Denial of Service), bypass certain security restrictions, and potentially compromise a vulnerable system.   They have the update marked as highly critical so it it suggested that users of SuSE upgrade immediately. The Secunia posting has links to all of the package downloads for each of the platform types and for multiple SuSE versions.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
328112
The ground rules of the tests of Cisco and Avaya systems.
336252
Issue #8 of the (IN)Secure Magazine has been posted today and includes articles like:  Payment Card Industry demystified Computer forensics vs. electronic evidence SSH port forwarding - security from two perspectives, part two Airscanner vulnerability summary: Windows Mobile security software fails the test Introducing the MySQL Sandbox   Check out insecuremag.com for more or just download the issue directly.
86222
In brief Exploit circulating for unpatched vuln
690905
Secunia has a new advisory posted that HP System Management Homepage users will want to take note of - an issue that's been found with how the PHP for this software is written that can lead to exploitable issues.   HP has acknowledged some vulnerabilities in HP System Management Homepage, which can be exploited by malicious people to disclose potentially sensitive information, bypass certain security restrictions, cause a DoS (Denial of Service), or potentially compromise a vulnerable system.   This issue has been reported in versions prior to 2.1.8 on Linux and Windows and the solution is easy - just upgrade to a newer version such as 2.1.8 or later. The Secunia post has links to some of the needed downloads.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
705643
The Hardened-PHP Project has released another vulnerability today, this time it's an issue with one of PHP's own internal functions - open_basedir.    The design of the open_basedir feature of PHP that is meant to disallow access to files outside a set of configured directories is vulnerable to race conditions.   It was discovered that this design flaw can be exploited with the usage of PHP's symlink() function in a very easy way. We believe that the only solution to this problem is disabling the function symlink() while open_basedir is used (this feature was therefore added to our Suhosin PHP Security Extension).    They also note, unfortunately, that the problem may not be fixable due to how it can be implemented. They provide a more detailed explaination and some PHP psuedo-code to help illustrate the point.
753031
On the PHP Security Blog, there's two new posts concerning their Suhosin patch for PHP - one talking about a remote code execution vulnerability found in the uploadprogressmeter extension (which as already been corrected) and the other dealing with the "stealth mode" of the patch to find compatibility problems.   As mentioned, the issue with the uploadprogress extension has been fixed and as been introduced into the PECL repository. The other post just mentions what the patch is doing to try to keep compatibility problems from happening due to back extensions and/or modules being loaded in an application.   More details about the Suhosin patch can be found here.