5 ms·

Though the author doesn't seem to be malicious in any way, he really should have reported it to the PHP core team as a security vulnerability before writing a b

Though the author doesn't seem to be malicious in any way, he really should have reported it to the PHP core team as a security vulnerability before writing a blog post. This could easily lead to denial-of-service attacks.

vessenes 16y ago
He asks "Is this serious?" halfway down the page, so I'm guessing he just didn't think about it. I'm sure it will be patched shortly, and equally sure some PHP core team member is like "F--!" right now.
mycroftiv 16y ago
Aren't a huge percentage of software bugs potential security vulnerabilities by this standard? I understand the wisdom of trying to get patches pushed out before publicly disclosing major exploits in mission critical software, but it seems unreasonable to expect users to not make statements of the form "program X crashes when I do such-and-such" in public discourse.
- cookiecaper 16y ago
  It just depends on how the crash is triggered. Most things that users run into in normal usage don't have very much potential to become a serious attack vector for lots of reasons -- many programs are not particularly network-aware or may not provide any service an attacker is interested in denying, the attack may require local access (which is still serious in some cases, but obviously less than something that can be exploited over the network by sending a malformed query), and so on. I think that the vast majority of stuff doesn't qualify as something that should be reported to a security team first. However, from a brief glance at the article, it appears that a remote user of a web application may be able to crash PHP entirely if he can find the right place to drop the number, denying access to all programs that depend on that PHP installation. That is a very serious bug and one incident can theoretically take out hundreds or thousands of sites and cost a lot of people a lot of money, not to mention time or frustration. Definitely seems like it should have hit the security group first to me.
  - mycroftiv 16y ago
    Yes, I understand that bugs in the "platform software" used by many internet services have the potential to rapidly affect a lot of users. However, I believe that it is unreasonable to expect users who experience a crash in php, or mysql, or any important application you can name, to not talk about the crash that happened. Software bugs are just too common to impose that restrictive a standard. In general, I believe statements of the form "this information is too dangerous to be shared publicly" are suspect, and we should maintain a strong presumption that as a general rule, it is OK to talk about problems publicly. When it comes to security issues, there is a difference between releasing deliberately crafted 0-day arbitrary remote code execution techniques and just making a public report of a crash you experienced. Perhaps the real issue is that the growing reliance upon internet services makes fault-tolerant engineering and fallback plans for handling failures very important. We need to make sure that hospitals/police/everything aren't dependent on systems that might break down completely because of bugs like this.
- JoachimSchipper 16y ago
  > Aren't a huge percentage of software bugs potential security vulnerabilities by this standard? Yes, which is why you should carefully reduce the number of bugs in your code - many bugs can be security issues, if the attacker is clever enough.
- lallysingh 16y ago
  Really? You didn't just try to look for web pages that end in ".php" and have a zip field? It's a pretty clear security vulnerability.
  - ms7821 16y ago
    Well, zips aren't numbers, but it's potentially a DoS vuln.
    - btilly 16y ago
      Lots of websites mistakenly use zips as numbers.
SimHacker 16y ago
That would be all well and fine in the idea world, but this is the PHP core team we're talking about here. They don't give a shit about security, and you have to publicly humiliate them into taking things like this seriously and doing anything about security.
anrevl01 16y ago
He did submit it to PHP. However, it seems the fastest way to get bugs patched on projects like PHP is to publicly announce the bug and let the public push the devs to fix it. Otherwise the report just languishes in the bug tracker and never gets fixed.

vessenes 16y ago

He asks "Is this serious?" halfway down the page, so I'm guessing he just didn't think about it. I'm sure it will be patched shortly, and equally sure some PHP core team member is like "F--!" right now.

mycroftiv 16y ago

Aren't a huge percentage of software bugs potential security vulnerabilities by this standard? I understand the wisdom of trying to get patches pushed out before publicly disclosing major exploits in mission critical software, but it seems unreasonable to expect users to not make statements of the form "program X crashes when I do such-and-such" in public discourse.

cookiecaper 16y ago
It just depends on how the crash is triggered. Most things that users run into in normal usage don't have very much potential to become a serious attack vector for lots of reasons -- many programs are not particularly network-aware or may not provide any service an attacker is interested in denying, the attack may require local access (which is still serious in some cases, but obviously less than something that can be exploited over the network by sending a malformed query), and so on. I think that the vast majority of stuff doesn't qualify as something that should be reported to a security team first. However, from a brief glance at the article, it appears that a remote user of a web application may be able to crash PHP entirely if he can find the right place to drop the number, denying access to all programs that depend on that PHP installation. That is a very serious bug and one incident can theoretically take out hundreds or thousands of sites and cost a lot of people a lot of money, not to mention time or frustration. Definitely seems like it should have hit the security group first to me.
- mycroftiv 16y ago
  Yes, I understand that bugs in the "platform software" used by many internet services have the potential to rapidly affect a lot of users. However, I believe that it is unreasonable to expect users who experience a crash in php, or mysql, or any important application you can name, to not talk about the crash that happened. Software bugs are just too common to impose that restrictive a standard. In general, I believe statements of the form "this information is too dangerous to be shared publicly" are suspect, and we should maintain a strong presumption that as a general rule, it is OK to talk about problems publicly. When it comes to security issues, there is a difference between releasing deliberately crafted 0-day arbitrary remote code execution techniques and just making a public report of a crash you experienced. Perhaps the real issue is that the growing reliance upon internet services makes fault-tolerant engineering and fallback plans for handling failures very important. We need to make sure that hospitals/police/everything aren't dependent on systems that might break down completely because of bugs like this.
JoachimSchipper 16y ago
> Aren't a huge percentage of software bugs potential security vulnerabilities by this standard? Yes, which is why you should carefully reduce the number of bugs in your code - many bugs can be security issues, if the attacker is clever enough.
lallysingh 16y ago
Really? You didn't just try to look for web pages that end in ".php" and have a zip field? It's a pretty clear security vulnerability.
- ms7821 16y ago
  Well, zips aren't numbers, but it's potentially a DoS vuln.
  - btilly 16y ago
    Lots of websites mistakenly use zips as numbers.

SimHacker 16y ago

That would be all well and fine in the idea world, but this is the PHP core team we're talking about here. They don't give a shit about security, and you have to publicly humiliate them into taking things like this seriously and doing anything about security.

anrevl01 16y ago

He did submit it to PHP. However, it seems the fastest way to get bugs patched on projects like PHP is to publicly announce the bug and let the public push the devs to fix it. Otherwise the report just languishes in the bug tracker and never gets fixed.