The Future of PHP Security

[Symantec]

The Future of PHP Security
<p>December 9, 2006, marks the day when long standing contributor to the PHP Security Response Team, Stefan Esser, <a href="http://blog.php-security.org/archives/61-Retired-from-securityphp.net.html">retired</a>. He has stated a few reasons for this latest move, primarily focusing on (in his opinion) the lack of response from his fellow colleagues and an extended delay in the patching of known vulnerabilities. Possibly another example of how some individuals or groups may choose to view “<a href="http://www.symantec.com/security/">responsible disclosure</a>.”</p>

<p>Over the years, SecurityFocus has reported on multiple vulnerabilities affecting PHP, such as BIDs <a href="http://www.securityfocus.com/bid/20879">20879</a> (PHP HTMLEntities HTMLSpecialChars Buffer Overflow Vulnerabilities), <a href="http://www.securityfocus.com/bid/19582">19582</a> (PHP Multiple Input Validation Vulnerabilities ), <a href="http://www.securityfocus.com/bid/20349">20349</a> (PHP ZendEngine ECalloc Integer Overflow Vulnerability), or <a href="http://www.securityfocus.com/bid/11964">11964</a> (PHP Multiple Local And Remote Vulnerabilities), to name a few. Attackers can leverage most of these issues to execute arbitrary machine code on the vulnerable computer. This can mean a remote compromise in the context of the Web server process.</p>

<p>With the recent loss – or more correctly, changing of venue – of Stefan Esser, what does the future hold for PHP security? In my opinion, the initial ramifications of this change will not likely be felt until early 2007. The first vulnerabilities reported may challenge what's left of the PHP Security Response team as they scramble to release updates to address the issues. But, in the long run, I feel this may light a fire under their collective “keyboards” to address issues in a more timely fashion. Hopefully, users won't suffer from extended delays in the patching of known issues – at least not for very long.</p>
http://www.symantec.com/enterprise/security_response/weblog/2006/12/the_future_of_php_security.html
http://www.symantec.com/enterprise/security_response/weblog/2006/12/the_future_of_php_security.html
Wed, 20 Dec 2006 07:00:00 -0800