Home •  Forum •  FAQ •  Search •  Recent Topics •  Memberlist •  Register •  Log in 
Forum » Non Icy Phoenix » Off Topic » English Chit Chat

Security Proplem In PHP

Reply to topic

 

spydie
Quote
Posts: 1796 Location: In the Boxes
Thu 12 Jan, 2012 23:16
Subject: Security Proplem In PHP
just stumbled other an important security hole in PHP by reading this article.

http://www.phpclasses.org/blog/post...of-Servers.html

I´m not shure, as for how important this is for Icy, but thought it might be interresting for some of you.

Profile PM   Website MSN
Hans
Quote
Posts: 120 Location: n43, w86
Fri 13 Jan, 2012 03:04
Subject: Re: Security Proplem In PHP
Yes, very interesting! Looks like the following quote is what people would need to worry about.

Quote:
This time the security researchers mentioned above contacted several language developers on November 1st, 2011. Not all language developers decided to give a prompt response. The response of PHP developers came in form of a patch to PHP 5.3.9 RC 4 and PHP 5.4.0 RC 4 that adds a new configuration option in php.ini named max_input_vars .

The max_input_vars option limits the number of request variables that PHP will accept. This means that if your server gets a HTTP request with more than a given number of GET, POST, COOKIE, etc. variables, the values are ignored.

It really does not avoid the whole problem of hash collisions but at least minimizes the bad consequences of an eventual attack. The default value of the max_input_vars option is 1000, but once you upgrade to PHP 5.3.9 which was just released, or PHP 5.4.0 that is expected to be released in a few weeks, I recommend that you lower this option value further, as most Web applications never need to handle so many request variables.


I will adjust that variable on my home server, 8) Thank you!

Profile PM   Website
Reply to topic
 

Page 1 of 1


  
You cannot post new topics
You cannot reply to topics
You cannot edit your posts
You cannot delete your posts
You cannot vote in polls
You cannot attach files
You can download files
You cannot post calendar events

   

This is a "Lo-Fi" version of our main content. To view the full version with more information, formatting and images, please click here.

Powered by Icy Phoenix based on phpBB
Generation Time: 0.1965s (PHP: 10% SQL: 90%)
SQL queries: 16 - Debug Off - GZIP Enabled