Is PHP secure?
Discussion
We run a prototyping IIS web server (much to the chagrin of the IT department) that has PHP running. I've just been given the heads up from the IT Manager that a security penetration test has flagged the PHP server a posing a security risk and he may shut it down.
Now, rather unhelpfully, he has not passed on the details of the problem.
So, is PHP inherently any less secure than other web dev apps (Cold Fusion, ASP etc)?
I suspect (hope) that the problem lies with the security of the IIS installation rather than anything specfic to PHP.
Any advice most welcome.
TIA
FG
Now, rather unhelpfully, he has not passed on the details of the problem.
So, is PHP inherently any less secure than other web dev apps (Cold Fusion, ASP etc)?
I suspect (hope) that the problem lies with the security of the IIS installation rather than anything specfic to PHP.
Any advice most welcome.
TIA
FG
PHP in itself isnt insecure, but applications written for / in PHP certainly can be.
There will always be bugs with any language which, with a modicum of sense and access to google, any kiddy can exploit over time.
I am sure 25%+ of the worlds internet servers run PHP
The solution is to keep ontop of upgrades.
J
There will always be bugs with any language which, with a modicum of sense and access to google, any kiddy can exploit over time.
I am sure 25%+ of the worlds internet servers run PHP
The solution is to keep ontop of upgrades.
J
FunkyGibbon said:
So, is PHP inherently any less secure than other web dev apps (Cold Fusion, ASP etc)?
it can be insecure but the latest versions are pretty darn good.
the reason its flagged as a security issue is because its free. non of the corporates make money from it so they pretend its evil, unlike the commercial equivalents.
We are moving to PHP for our systems at work and I have been on a few courses, the one thing the trainer kept saying was that PHP is enormously configurable (maybe too configurable for it's own good) and out of the box (i.e standard installation) it is VERY insecure. However once properly set up it is very secure.
An example he used was to make all files in the webserver directory processed by the PHP engine. If you don't and a dev miss types the extension of the file or people are snooping around for included files and the like, the whole file will be passed to the browser as html and thus the user can view the source. This may contain passwords and clues to tables etc. in the databases which could be used for an attack. If they are all processed by the PHP engine all files will only send HTML tags to the browser.
An example he used was to make all files in the webserver directory processed by the PHP engine. If you don't and a dev miss types the extension of the file or people are snooping around for included files and the like, the whole file will be passed to the browser as html and thus the user can view the source. This may contain passwords and clues to tables etc. in the databases which could be used for an attack. If they are all processed by the PHP engine all files will only send HTML tags to the browser.
tinman0 said:
the reason its flagged as a security issue is because its free. non of the corporates make money from it so they pretend its evil, unlike the commercial equivalents.
that was exactly my initial thought too, just because it ain't micro$oft and cost 30K a year for a licence it must be a security threat.
FunkyGibbon said:
the reason its flagged as a security issue is because its free. non of the corporates make money from it so they pretend its evil, unlike the commercial equivalents.
that was exactly my initial thought too, just because it ain't micro$oft and cost 30K a year for a licence it must be a security threat.
Except that asp & asp.net don't cost anything to serve once you have an IIS server?
there are some complete muppets doing pen testing (and a lot of skilled people). I would ask to see the report and ensure that they have detailed and quantified the risks of running PHP (or a.n.other service). If they haven't done this then it's not worth the paper it's written on.
This way you have the opportunity to go through them and identifying mitigating controls or to challenge their findings.
This way you have the opportunity to go through them and identifying mitigating controls or to challenge their findings.
Something to consider if you feel that a system may be exposed is to firewall the system in question, then use a reverse proxy server on the DMZ to allow access.
This way it's extremelyunlikely that the PHP (or whatever) system will be compromised and if the reverse proxy is, it's on the DMZ and has no data on it anyway.
This way it's extremelyunlikely that the PHP (or whatever) system will be compromised and if the reverse proxy is, it's on the DMZ and has no data on it anyway.
FunkyGibbon said:
found out what the security threat was:
The only public page on the server (rest is protected by IP or username/password) is a test PHP page that displays the server environment variables and the setup parameters. This has now been removed.
FG
So you had only recently set ti up and left the default config page up?
Everyone does that.. a few times.
FunkyGibbon said:
Which version of PHP are you using? Some versions are more secure than others. Of course if you protect the directory you should have limited (if any) problems...
ErnestM
PHP Version 5.0.5
You're fine. As long as you have a well secured web server you should have a minimum (if any) of issues.
ErnestM
ErnestM said:
Which version of PHP are you using? Some versions are more secure than others. Of course if you protect the directory you should have limited (if any) problems...
ErnestM
PHP Version 5.0.5
You're fine. As long as you have a well secured web server you should have a minimum (if any) of issues.
ErnestM
cheers!
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff