<html><body bgcolor="#FFFFFF"><div>Please do remember that I did not write all the code present in ZendTo, it started off life as a different project by other people. But I will rapidly fix any problems brought to my attention with constructive advice on how to fix them.<br><br>-- <div>Jules</div></div><div><br>On 19 Aug 2010, at 02:21 PM, "Duncan, Brian M." <<a href="mailto:brian.duncan@kattenlaw.com">brian.duncan@kattenlaw.com</a>> wrote:<br><br></div><div></div><blockquote type="cite"><div>
<div dir="ltr" align="left"><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2">My intent was not to create a discussion on how open
to attack PHP is related to other products.</font></span></div>
<div dir="ltr" align="left"><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2"></font></span> </div>
<div dir="ltr" align="left"><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2">Nesuus was obviously displaying high importance alerts
based on the PHP banner version that was being returned when I still
had expose=on in the php.ini. </font></span></div>
<div dir="ltr" align="left"><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2"></font></span> </div>
<div dir="ltr" align="left"><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2">If you are saying that all the vulnerabilities that are
present in the version that is installed can only be exploited with poorly
coded PHP code, then I am not concerned if Jules is not
..</font></span></div>
<div><font face="Arial" color="#0000ff" size="2"></font> </div>
<div><span class="054440713-19082010"><font face="Arial" color="#0000ff" size="2"></font></span> </div><!-- Converted from text/plain format -->
<p><font size="2">BRIAN M. DUNCAN<br>Data Security Administrator<br>Katten Muchin
Rosenman LLP<br>525 W. Monroe Street / Chicago, IL 60661-3693<br>p / (312)
577-8045 f / (312) 577-4490<br><a href="mailto:brian.duncan@kattenlaw.com">brian.duncan@kattenlaw.com</a> /
<a href="http://www.kattenlaw.com"><a href="http://www.kattenlaw.com">www.kattenlaw.com</a></a><br> </font></p>
<div> </div><br>
<div class="OutlookMessageHeader" lang="en-us" dir="ltr" align="left">
<hr tabindex="-1">
<font face="Tahoma" size="2"><b>From:</b> <a href="mailto:zendto-bounces@zend.to">zendto-bounces@zend.to</a>
[mailto:zendto-bounces@zend.to] <b>On Behalf Of </b>Sergio
Rabellino<br><b>Sent:</b> Wednesday, August 18, 2010 6:08 PM<br><b>To:</b>
<a href="mailto:zendto@zend.to"><a href="mailto:zendto@zend.to">zendto@zend.to</a></a><br><b>Subject:</b> [ZendTo] Re: Question related to version of
PHP in CentOS VM's<br></font><br></div>
<div></div>I'm running php web sites along 10 years, i'd never had a succesful
attack to php itself, but only to bad (php) programmers.<br>I think that nessus
it's very conservative in its results, but not every buffer overflow can lead to
a breach in your system.<br>What programming language/environment you believe
it's unfaceable ? Tomcat/Java or whatsoever ? :-)<br><br>regards.<br><br>Duncan,
Brian M. ha scritto:
<blockquote cite="mid:65234743FE1555428435CE39E6AC407803795174@CHI-US-EXCH-01.us.kmz.com" type="cite">
<div dir="ltr" align="left"><font face="Arial" color="#0000ff" size="2"><span class="823452818-18082010">I've always shied away from using PHP with apache on
externally facing web sites in the past due to always seeing a constant
flow of new vulnerabilities.</span></font></div>
<div> </div>
<div><span class="823452818-18082010"><font face="Arial" color="#0000ff" size="2">Does
anyone know if the version of PHP that is current according to CentOS
safe?</font></span></div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010"><font face="Arial" color="#0000ff" size="2">I
ran a Nessus scan against my Zendto box and it is listing 6
"HIGH" security risks so far that are supposedly tied to PHP
version. I just noticed they all refer so far to using PHP 5.2.5 or
later. Not sure if any of these are false positives
yet.</font></span></div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010"><font face="Arial" color="#0000ff" size="2">Here
is some of the Nessus "HIGH" security scan listed output for any
interested:</font></span></div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010"></span> </div>
<div><span class="823452818-18082010">
<table cellspacing="0" cellpadding="2" width="70%" align="center" border="0">
<tbody>
<tr class="plugin_sev_high">
<td class="plugin_label" align="left">PHP < 5.2.5 Multiple
Vulnerabilities</td></tr>
<tr class="info_bg">
<td class="info_text" colspan="2">
<div class="plugin_output"><br><b>Synopsis:</b><br>The remote web server
uses a version of PHP that is affected by multiple
flaws.<br><br><b>Description:</b><br>According to its banner, the
version of PHP installed on the remote host is older than 5.2.5. Such
versions may be affected by various issues, including but not limited to
several buffer overflows.<br><br><b>Risk
factor:</b><br>High<br><br><b>CVSS Base
Score:</b>7.5<br>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P<br><br><b>See
also:</b><br><a class="moz-txt-link-freetext" href="http://www.php.net/releases/5_2_5.php"><a href="http://www.php.net/releases/5_2_5.php">http://www.php.net/releases/5_2_5.php</a></a><br><br><b>Solution:</b><br>Upgrade
to PHP version 5.2.5 or later.<br><br><b>Plugin output:</b><br>PHP
version 5.1.6 appears to be running on the remote host based on the
following X-Powered-By response header : X-Powered-By: PHP/5.1.6
<br><br><b>Plugin ID:</b><br><a href="http://www.nessus.org/plugins/index.php?view=single&id=28181" moz-do-not-send="true">28181</a><br><br><b>CVE: </b><br>CVE-2007-4887,
CVE-2007-5898, CVE-2007-5900<br><br><b>BID: </b><br><a href="http://www.securityfocus.com/bid/26403" moz-do-not-send="true">26403</a><br><br><b>Other references:
</b><br>OSVDB:38680, OSVDB:38681, OSVDB:38682, OSVDB:38683, OSVDB:38684,
OSVDB:38685</div></td></tr></tbody></table>
<table cellspacing="0" cellpadding="2" width="70%" align="center" border="0">
<tbody>
<tr class="plugin_sev_high">
<td class="plugin_label" align="left">PHP < 5.2.1 Multiple
Vulnerabilities</td></tr>
<tr class="info_bg">
<td class="info_text" colspan="2">
<div class="plugin_output"><br><b>Synopsis:</b><br>The remote web server
uses a version of PHP that is affected by multiple
flaws.<br><br><b>Description:</b><br>According to its banner, the
version of PHP installed on the remote host is older than 5.2.1. Such
versions may be affected by several issues, including buffer overflows,
format string vulnerabilities, arbitrary code execution, 'safe_mode' and
'open_basedir' bypasses, and clobbering of super-globals.<br><br><b>Risk
factor:</b><br>High<br><br><b>CVSS Base
Score:</b>7.5<br>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P<br><br><b>See
also:</b><br><a class="moz-txt-link-freetext" href="http://www.php.net/releases/5_2_1.php"><a href="http://www.php.net/releases/5_2_1.php">http://www.php.net/releases/5_2_1.php</a></a><br><br><b>Solution:</b><br>Upgrade
to PHP version 5.2.1 or later.<br><br><b>Plugin output:</b><br>PHP
version 5.1.6 appears to be running on the remote host based on the
following X-Powered-By response header : X-Powered-By: PHP/5.1.6
<br><br><b>Plugin ID:</b><br><a href="http://www.nessus.org/plugins/index.php?view=single&id=24907" moz-do-not-send="true">24907</a><br><br><b>CVE: </b><br>CVE-2006-6383,
CVE-2007-0905, CVE-2007-0906, CVE-2007-0907, CVE-2007-0908,
CVE-2007-0909, CVE-2007-0910, CVE-2007-1376, CVE-2007-1380,
CVE-2007-1453, CVE-2007-1700, CVE-2007-1701, CVE-2007-1824,
CVE-2007-1825, CVE-2007-1884, CVE-2007-1885, CVE-2007-1886,
CVE-2007-1887, CVE-2007-1890<br><br><b>BID: </b><br><a href="http://www.securityfocus.com/bid/21508" moz-do-not-send="true">21508</a>, <a href="http://www.securityfocus.com/bid/22496" moz-do-not-send="true">22496</a>, <a href="http://www.securityfocus.com/bid/22805" moz-do-not-send="true">22805</a>, <a href="http://www.securityfocus.com/bid/22806" moz-do-not-send="true">22806</a>, <a href="http://www.securityfocus.com/bid/22862" moz-do-not-send="true">22862</a>, <a href="http://www.securityfocus.com/bid/22922" moz-do-not-send="true">22922</a>, <a href="http://www.securityfocus.com/bid/23119" moz-do-not-send="true">23119</a>, <a href="http://www.securityfocus.com/bid/23120" moz-do-not-send="true">23120</a>, <a href="http://www.securityfocus.com/bid/23219" moz-do-not-send="true">23219</a>, <a href="http://www.securityfocus.com/bid/23233" moz-do-not-send="true">23233</a>, <a href="http://www.securityfocus.com/bid/23234" moz-do-not-send="true">23234</a>, <a href="http://www.securityfocus.com/bid/23235" moz-do-not-send="true">23235</a>, <a href="http://www.securityfocus.com/bid/23236" moz-do-not-send="true">23236</a>, <a href="http://www.securityfocus.com/bid/23237" moz-do-not-send="true">23237</a>, <a href="http://www.securityfocus.com/bid/23238" moz-do-not-send="true">23238</a><br><br><b>Other references:
</b><br>OSVDB:32763, OSVDB:32764, OSVDB:32765, OSVDB:32766, OSVDB:32767,
OSVDB:32768, OSVDB:32776, OSVDB:32781, OSVDB:33269, OSVDB:33933,
OSVDB:33944, OSVDB:33945, OSVDB:33955, OSVDB:33957, OSVDB:33958,
OSVDB:33959, OSVDB:33960, OSVDB:34767</div></td></tr></tbody></table>
<table cellspacing="0" cellpadding="2" width="70%" align="center" border="0">
<tbody>
<tr class="plugin_sev_high">
<td class="plugin_label" align="left">PHP < 5.2.4 Multiple
Vulnerabilities</td></tr>
<tr class="info_bg">
<td class="info_text" colspan="2">
<div class="plugin_output"><br><b>Synopsis:</b><br>The remote web server
uses a version of PHP that is affected by multiple
flaws.<br><br><b>Description:</b><br>According to its banner, the
version of PHP installed on the remote host is older than 5.2.4. Such
versions may be affected by various issues, including but not limited to
several overflows.<br><br><b>Risk factor:</b><br>High<br><br><b>CVSS
Base Score:</b>7.5<br>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P<br><br><b>See
also:</b><br><a class="moz-txt-link-freetext" href="http://www.php.net/releases/5_2_4.php"><a href="http://www.php.net/releases/5_2_4.php">http://www.php.net/releases/5_2_4.php</a></a><br><br><b>Solution:</b><br>Upgrade
to PHP version 5.2.4 or later.<br><br><b>Plugin output:</b><br>PHP
version 5.1.6 appears to be running on the remote host based on the
following X-Powered-By response header : X-Powered-By: PHP/5.1.6
<br><br><b>Plugin ID:</b><br><a href="http://www.nessus.org/plugins/index.php?view=single&id=25971" moz-do-not-send="true">25971</a><br><br><b>CVE: </b><br>CVE-2007-2872,
CVE-2007-3378, CVE-2007-3806<br><br><b>BID: </b><br><a href="http://www.securityfocus.com/bid/24661" moz-do-not-send="true">24661</a>, <a href="http://www.securityfocus.com/bid/24261" moz-do-not-send="true">24261</a>, <a href="http://www.securityfocus.com/bid/24922" moz-do-not-send="true">24922</a>, <a href="http://www.securityfocus.com/bid/25498" moz-do-not-send="true">25498</a><br><br><b>Other references:
</b><br>OSVDB:36083, OSVDB:36085, OSVDB:36869</div></td></tr></tbody></table>
<table cellspacing="0" cellpadding="2" width="70%" align="center" border="0">
<tbody>
<tr class="plugin_sev_high">
<td class="plugin_label" align="left">PHP < 5.2 Multiple
Vulnerabilities</td></tr>
<tr class="info_bg">
<td class="info_text" colspan="2">
<div class="plugin_output"><br><b>Synopsis:</b><br>The remote web server
uses a version of PHP that is affected by multiple buffer
overflows.<br><br><b>Description:</b><br>According to its banner, the
version of PHP installed on the remote host is older than 5.2. Such
versions may be affected by several buffer overflows. To exploit these
issues, an attacker would need the ability to upload an arbitrary PHP
script on the remote server, or to be able to manipulate several
variables processed by some PHP functions such as
htmlentities().<br><br><b>Risk factor:</b><br>High<br><br><b>CVSS Base
Score:</b>7.5<br>CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P<br><br><b>See
also:</b><br><a class="moz-txt-link-freetext" href="http://www.php.net/releases/5_2_0.php"><a href="http://www.php.net/releases/5_2_0.php">http://www.php.net/releases/5_2_0.php</a></a><br><br><b>Solution:</b><br>Upgrade
to PHP version 5.2.0 or later.<br><br><b>Plugin output:</b><br>PHP
version 5.1.6 appears to be running on the remote host based on the
following X-Powered-By response header : X-Powered-By: PHP/5.1.6
<br><br><b>Plugin ID:</b><br><a href="http://www.nessus.org/plugins/index.php?view=single&id=31649" moz-do-not-send="true">31649</a><br><br><b>CVE:
</b><br>CVE-2006-5465<br><br><b>BID: </b><br><a href="http://www.securityfocus.com/bid/20879" moz-do-not-send="true">20879</a><br><br><b>Other references:
</b><br>OSVDB:30178, OSVDB:30179</div></td></tr></tbody></table>
<table cellspacing="0" cellpadding="2" width="70%" align="center" border="0">
<tbody>
<tr class="plugin_sev_high">
<td class="plugin_label" align="left">PHP 5 < 5.2.7 Multiple
Vulnerabilities</td></tr>
<tr class="info_bg">
<td class="info_text" colspan="2">
<div class="plugin_output"><br><b>Synopsis:</b><br>The remote web server
uses a version of PHP that is affected by multiple
flaws.<br><br><b>Description:</b><br>According to its banner, the
version of PHP installed on the remote host is older than 5.2.7. Such
versions may be affected by several security issues : - File truncation
can occur when calling 'dba_replace()' with an invalid argument. - There
is a buffer overflow in the bundled PCRE library fixed by 7.8.
(CVE-2008-2371) - A buffer overflow in the 'imageloadfont()' function in
'ext/gd/gd.c' can be triggered when a specially crafted font is given.
(CVE-2008-3658) - There is a buffer overflow in PHP's internal function
'memnstr()', which is exposed to userspace as 'explode()'.
(CVE-2008-3659) - When used as a FastCGI module, PHP segfaults when
opening a file whose name contains two dots (eg, 'file..php').
(CVE-2008-3660) - Multiple directory traversal vulnerabilities in
functions such as 'posix_access()', 'chdir()', 'ftok()' may allow a
remote attacker to bypass 'safe_mode' restrictions. (CVE-2008-2665 and2</div></td></tr></tbody></table></span></div></blockquote></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>ZendTo mailing list</span><br><span><a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a></span><br><span><a href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></span></div></blockquote></body></html>