Hardened-PHP Project: Advisory - PHProjekt (Remote) Include Vulnerabilities
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
190663
Joshua Eichorn points out an interesting project in a new post to his blog today - quercus.   I found an interesting project, quercus that compiles PHP to Java Bytecode allowing it to run ontop of the Java Resin Application Server. It has a couple neat features, one being PHP6 compatible unicode support, the other being easy integration between Java and PHP code.   He gave it a shot and notes that the performance seems decent and allows you to compensate for some of the differences in the PHP API it supports and what you're using via a Java class. According to their site:   Quercus is Caucho Technology's 100% Java implementation of PHP 5 released under the Open Source GPL license. Quercus comes with many PHP modules and extensions like PDF, PDO, MySQL, and JSON. Quercus allows for tight integration of Java services with PHP scripts, so using PHP with JMS or Grails is a quick and painless endeavor.   It includes several extensions too, including the JSON library, APC, MySQL and Oracle support, and PDF functionality. Check out their Getting Started guide, documentation, or their wiki for more information.
570691
According to this new advisory on the Secunia website, rPath has updated more of their PHP packages and has marked the update as "moderately critical" to keeping your systems safe.   rPath has issued an update for multiple php packages. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious, local users and malicious users to bypass certain security restrictions.   The original advisory has links to the updated versions and to references as to what has changed.   In its default configuration, rPath Linux 1 does not install php5 and is thus not vulnerable to these attacks; however, systems to which php5 has been added may be vulnerable to one or more of these attacks.
649335
Michael Kimsal has posted some more thoughts on what he calls the "sad state of PHP development" pointing out some of the practices of the PHP group surrounding the development of the language.   Every few months there's a release, whether large or small, which introduces new features and bug fixes. However, with every release also comes fears of tiny, sometimes undocumented, changes that break existing code, and often for no solid reason other than someone with commit access decided they liked the 'new' way better than the old way.   He points out a specific example, get_object_vars and how its return values were changed in an earlier release as well as the update to glob made recently to change its return types.    In his opinion:   No changes should be made to the PHP core without an issue being opened, either in the 'bug' tracker or some other issues tracker.   Be sure to check out the comments for other great opinions on the topic.
386588
Latest PHPClasses.org Releases:Smarty and MIME message integrationYour SayphpPhotoGalleryInterfacesIlariaParser 7just7.comaDB PDO like database abstractionSAMP Socket
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
559035
Michael Kimsal has posted a formal prediction that a patch, created by someone in the community, will emerge making it simple to bridge the gap between PHP4 and PHP5 applications.   Given the high number of shared hosts still running PHP4, the backwards compatibility issues going from 4->5 (yes, there are some!) and the new PHP4 "end of life" date (8/8/8), someone will likely find a way to make these run together, and possibly even charge money for it.   He suggests that many hosts out there would happily pay a sum to get this kind of functionally for their customers. It would provide a solution to customers who just don't understand the force towards PHP5 and would make them (and their PHP4 applications) happier.
135369
A quick post from janschneider.de talks about questions regarding the PHP5 compatibility of Horde, IMP, or other applications on the Horde mailing list
563007
Secunia has release a new advisory for SUSE linux users to point them to the update of the PHP packages on their system to correct a highly critical issue.   SUSE has issued an update for php. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious people to disclose potentially sensitive information, to bypass certain security restrictions, to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.   Operating systems included in the advisory are systems running SUSE Linux, UnitesLinux, and openSUSE linux. Package updates are linked from the advisory so you can quickly and easily update your packages.
714118
On Secunia.com, two new updates for the Debian linux distribution have been posted - on for PHP4 and the other for PHP5:   Debian has issued an update for php4/5. This fixes some vulnerabilities, which can be exploited by malicious people to conduct cross-site scripting attacks, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.   You can get more information and links to the downloads here:   PHP4 announcement PHP5 announcement
710524
In this new post on the Northclick blog, Soenke talks about the stream wrappers included in PHP and some of the magic that can happen when they're applied correctly. In this case, it's an application of the ssh2 library (by Sara Golemon).   The new system must be very stable with a strict error checking and has to support several ways of file transports (FTP, SCP/SFTP). SCP is faster then FTP and secure by nature. It's going to be the standard way for deployment.   After finding and loading the extension, things flowed along swimmingly - the code shows a simple transfer method of transfer over a secure ftp connection, complete with a few performance stats at the end.
153432
rPath linux has issued an update to their packages for PHP, PHP-MySQL and PHP-PGSql to correct issues that could make it possible for a remote user to gain unauthorized access.   his fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions or by malicious people to potentially compromise a vulnerable system.   References and links to the update information can be found in their original advisory.
415712
To set things right about a misquote on Slashdot, Zeev Suraksi has posted this long statement mentioning what he really said and a few more personal opinions.   I've just been misquoted on Slashdot, as if I said there are no security problems in PHP itself, and that I instead point my finger only at inexperienced developers. If you read the original article on Heise Security, you'll see that I have not said anything of the sort. [...] I believe this is the belief of most others on the security team, but I'm only speaking on behalf of myself and do not represent them.   He also covers five more points pertaining to the article and the situation:  Where the bugs/problems lie with problems in PHP Why there are security problems in web PHP applications Why the current security level can be partially blamed on the language itself An admission that yes, there are security problems in PHP And the track record the PHP developers have had in fixing these issues  There's much more than just these brief highlights here, so I encourage you to head on over and check out the full post for yourself.   There are some other opinions on the matter from a few others out there too:  cyberlot's blog Zend Developer Zone's post Tony Bibbs' blog
641738
In a new post to his blog, Robert Swarthout about a PHP frontend he's been developing for working with Subversion repositories:   The frontend needed to be designed in such a way that each developer could access their working copies and make the full range of actions against them. I decided to also use an AJAX setup so that pages would be quickly loaded and updated by a single toggle of a folder.   A few issues popped up, including tracking edits correctly through the interface. His solution revolved around an Apache MPM that could serve different pages to different users and groups. With this solution in place, the functionality could be built up, a list of which he provides including:  create working copy from repository (svn checkout) svn blame svn delete search files (via a grep/find combination, omitting .svn folders) svn rename
49129
Over on the SecurityFocus website, there's an interview posted with Stefan Esser of the Hardened-PHP Project (as interviewed by Federico Biancuzzi.   Federico Biancuzzi discussed with him how the PHP Security Response Team works, why he resigned from it, what features he plans to add to his own hardening patch, the interaction between Apache and PHP, the upcoming "Month of PHP bugs" initiative, and common mistakes in the design of well-known applications such as WordPress.   Some of the topics discussed include  the Hardened-PHP Project Suhosin the PHP Security Response Team (his role in it and why he left) PHP5's security focus versus PHP4's and more...  Check out the full interview to have all of your questions answered.
261062
Latest PHPClasses.org Releases:SPL and IteratorsBWT & MTF encodercPanel Sub-domains CreatorObserverableHTTP SpySimple and Attachment Send MailWindows RegistryClean OutputCryptPHP RARRTF Generation ClassBar ChartPclTemplateICQ Protocol
705643
The Hardened-PHP Project has released another vulnerability today, this time it's an issue with one of PHP's own internal functions - open_basedir.    The design of the open_basedir feature of PHP that is meant to disallow access to files outside a set of configured directories is vulnerable to race conditions.   It was discovered that this design flaw can be exploited with the usage of PHP's symlink() function in a very easy way. We believe that the only solution to this problem is disabling the function symlink() while open_basedir is used (this feature was therefore added to our Suhosin PHP Security Extension).    They also note, unfortunately, that the problem may not be fixable due to how it can be implemented. They provide a more detailed explaination and some PHP psuedo-code to help illustrate the point.