A.P. Lawrence

Security begins at home

Author: TonyLawrence
Date: Wed Apr 20 11:01:59 2005
Subject: Security begins at home

Yesterday there was another PHP security flaw announced: http://www.techworld.com/security/news/index.cfm?NewsID=3514

I don't mean to belittle the importance of this, but this and even most reported exploits are conditional things and not necessarily something you need to jump on to correct. In this particular case, the reported problems have to do with uploading images. If your php website doesn't have a function that allows users to upload images, this flaw doesn't affect you.

Very often, reported flaws depend upon specific situations. Sometimes it's very obvious: if you don't allow port 23 inward to your systems, you don't have to worry about telnet security flaws except perhaps from local users. But often you have to dig through a lot of detail to figure out just how the flaw would be exploited, and even then it's not always easy for a non-technical user to figure out. It's not always particularly easy for a fairly tech savvy user either.

`

Let's take a hypothetical case of a new security flaw discovered in the sshd package. Remember, this is hypothetical, a made up case: don't go looking for a patch. We'll pretend that this is a problem that is reported as allowing root login without a password. That would be pretty scary stuff, right?

OK, but your sshd servers are configured not to accept anything but public key authentication so ordinarily nobody but the specific sites you allow can ever login - at least not without someone stealing keys. So does this flaw affect you? Maybe, maybe not, but I bet you'd have a hard time finding out. Although this is a hypothetical case, I've had similar situations in the past where I just wasn't sure if a reported exploit had anything to do with my specific situation.

You might say "so just patch it - be certain". Yes, of course. But that can take time, and that's particularly true when the report affects multiple machines. Fixing the problem can consume more time than you would like to give it right now, and of course can also mean interruption of service for users, maybe even rebooting and sometimes major changes in other applications that depend upon some feature that now has to work slightly differently. In other words, it can be a big sticky mess, so it may be worth the effort to determine if the reported exploit really does affect you.

This particular PHP problem doesn't affect me, so I can safely ignore it. I wish I could say the same for every security flaw.

Enter your email address for automatic notification of new posts here
(be sure to whitelist 'feedburner.com' if you use spam filtering)

Or use any RSS reader

Delivered by FeedBurner

---

Views for this page
Today	This Week	This Month	This Year	Overall
3	3	27	409	1,459

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here