iBlog - Ilia Alshanetsky

Finally got around to releasing the next stable release of FUDforum, 2.6.13. For the most part it is the same as RC2, with just a few note worthy changes. The Japanese and Romanian translations were updated, Win32 finally has proper timezone support through a custom subset of timezone values and some more adjustments to the nested category display. The latter seems to have been an ongoing problem throughout the .13 release cycle and I sincerely hope we've finally hammered out all of the possible problems with it.

The upgrade and installation scripts are available at the usual location:
http://fudforum.org/download.php.

On a related note, I am now working on a PDO database driver for the forum. This will allow FUDforum to expand it's database support beyond MySQL and PostgreSQL as well as benefit from an improved API offered by PDO. Many of PDO's convenience functions would significantly simplify the process of retrieving data for certain operations.

One conference is over and another one is already in the works. I've been invited to speak about PHP & Performance at OSCON on August 3rd, 2005. This is my first visit to a non-PHP specific conference as a speaker and I very much look forward to it.

As most of you hopefully know, a few days ago PHP 4.3.10 and 5.0.3 were released in response to several vulnerabilities that were discovered. Two of those involved bugs in unserialize function that is used to re-create PHP variables based on an encoded string normally generated by serialize() function. This functionality allows storage & retrieval of PHP variables from outside PHP.
While these two problems are quite serious, they can normally only be exploited locally, meaning that you'd need an account with access to PHP on the server. However, several applications such as phpBB store serialized data inside cookies meaning that anyone accessing those applications will be able to supply their own serialized string. By tinkering with this string it is possible to make an exploit capable of doing things like theft of passwords.

In response to this development phpBB developers decided to put the following statement out "This is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions".

First of all this is not a correct analysis of the situation, the only applications vulnerable are the ones that expose serialized data to the user allowing them to modify it, like phpBB does. Even if the bug in serialized code did not exist, there are still issues with exposing serialized data to the user without validation. There is nothing to prevent someone from generating a very complex data structure that would take long time to parse and use it as a means of launching a resource depletion attack. It also means that by modifying the serialized string it is possible to inject all manner of data into the script which may lead to exploits due to uninitialized variables, etc... Ultimately it comes down to blindly trusting the user with your data and expecting not to get penalized for it.

While unserialize is certainly a bug in PHP, the fact it is remotely exploitable is the fault of script writers who do not take the time to properly validate user input.