Bugtraq mailing list archives
Re: PHP as a secure language? PHP worms?
From: Duncan Simpson <dps () simpson demon co uk>
Date: Tue, 02 Jan 2007 12:01:36 +0000
Nobody has seen fit to point this out but there *are* secure languages. In general these languages have limited feature sets or, at least in the case of java, explicit sandbox features intended to stop bad things happenning. Groups of monks competing for an abacus are probably unable to read your password file, for example. Some languages make particular vsorts of vulnerability easy to implement and arguably this is a bad thing. Nobody would not be hit if they did proper input validation but that requires real effort and is tedious to implement. PHP's URL as filename and register_globals features make several sorts of abuse trivial. I know the latter is off by default but lots of vulnerable scripts require you to enable this feature. C makes bofs and integer overflows easy to implement but fopen(3) lacks magic features, so putting http://evil.example.com/evilcode? in front of a filename gets the crackers nowhere. Arguably writing CGI applications is harder too, so those that do have more clues. perl is nice but you have to wacth out for strings containing nulls and the magic features of perl's open function. etc ad infinitum. I am currently using C for my CGI programs but that is because several large operations that get used a lot are a few thousands lines of C for speed. My choice of CGI library also offers ZIP arhive expansion and there are multiple instance where this is useful (the filenames in the ZIP acrhive are ignored). AFAIK there are no bof, integer overflow or SQL injection features yet :-) -- Duncan (-: "software industry, the: unique industry where selling substandard goods is legal and you can charge extra for fixing the problems." -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
Current thread:
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware], (continued)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 01)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Darren Reed (Jan 02)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 02)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Darren Reed (Jan 02)
- RE: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Harrison (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Bill Nash (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Ronald Chmara (Jan 04)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Jim Manico (Jan 08)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Dana Hudes (Jan 02)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Lawrence Paul MacIntyre (Jan 04)
- Re: PHP as a secure language? PHP worms? Duncan Simpson (Jan 02)
- RE: PHP as a secure language? PHP worms? Jim Harrison (Jan 02)
- Re: PHP as a secure language? PHP worms? [was: Re: new linux malware] Kevin Waterson (Jan 02)