Security expert Stefan Esser has declared war on vulnerabilities in the PHP core with the "Month of PHP Bugs." PHP is an open-source HTML embedded scripting language used to create dynamic Web pages. The month-long effort is an attempt to improve the security of PHP, Esser said in a post on his Web site. It follows his contentious departure in December from the PHP Security Response Team, which he founded, after he accused The PHP Group of being too slow to fix problems.
Esser stressed, however, that he is not striking back at his old colleagues but is addressing legitimate security issues. "During March 2007, old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day-by-day basis," he wrote. "We will also point out necessary changes in the current vulnerability management process used by the PHP Security Response Team."
View: The full story
News source: eWeek
Esser stressed, however, that he is not striking back at his old colleagues but is addressing legitimate security issues. "During March 2007, old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day-by-day basis," he wrote. "We will also point out necessary changes in the current vulnerability management process used by the PHP Security Response Team."
View: The full story News source: eWeek
On the serious side, identifying problems is good. Public release of bug info before letting the responsible party work on it is bad.
I agree that finding the problems is good, but if you tell the company or people in charge of the product about them, and nothing gets fixed after a long time, public release of bug info is the only way to get them to fix things.
If the vendors don't respond/react, then I can see benefit to public disclosure. However, these idiots are publicly releasing information without proper advance notification to the responsible vendors.
http://bugs.php.net/bug.php?id=40487
idiots
If any of the problems detailed above were a serious issue then there would be a lot more than ONE person posting a bug on the PHP bug portal. They wont be the only person using that software combo and seing the majority of sites use sessions in one way or another that would be a SERIOUS issue. That is most likely due to be a config issue or a problem somewhere else and the amount of people who post a bug saying "Oh Noesss" when they screw something up makes me laugth.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.