PHP - 11

The slides from PHP|Tek are now up. The Security Tutorial slides can be found here and the PDO Introduction slides can be found here, to all attending thank you for listening and hopefully at-least a bit of the content was interesting and useful

Finally got a few moments to recap the PHP Quebec 2006 Conference, which as usual, was a great success and a great deal of fun. I’d like to thank the organizers for doing an amazing job and bringing a great group of people together from both the development and user communities. My talks during the conference went quite well, and I am especially happy with the PDO talk, this topic seemed of particular interest to the audience and I hope we’d get a couple of new PDO users out of it The slides from my talks are now available online and can be found here:

PHP Security: PowerPoint || PDF
Introduction to PDO: PowerPoint || PDF

Chris Schifflet has transferred me the reigns of the PHP|Architect's Security Corner; hopefully I will be able to keep up with the tradition of interesting and informative articles on the topic of PHP Security. The first issue was released on March 20ths and takes you on a road of discovery about Cross-Site Request Forgery (CSRF). My approach was to identify the various means of exploitation possible via CSRF and the possible dangers it presents. By taking this approach not only can the uniqueness of the attack's approach can be demonstrated, but the hacking methodologies used by malicious users can seen as well. In my mind, understanding of the problem is half the solution, of course the other half involving prevention techniques design to avert CSRF are covered as well. If you are interested in learning more about CSRF you may want to grab an issue of the magazine.

While talking with PHP developers this morning I thought of another way unverified serialized strings could be abused. This exploit can only affect PHP 5 installs though, but given the growing market share of PHP 5 it is certainly something worth noting.

As you may know classes in PHP are allowed to implement a magic method called __wakeup() that contains operation that are to be performed when a class is deserialized. Some native classes like PDO implement this function with a goal of preventing database serialization and throw an error when it is used. Herein lies the abuse, the attack simply needs to specify a short serialized string that looks like a serialized version of a supposed PDO object.




When PHP tries to unserialize it, it determines that PDO class has a __wakeup() method and promptly calls it. However, since the method is disallowed, it triggers an exception which, if left uncaught terminates the script with a fatal error. Since most people do not expect unserialize() to throw exceptions leave it outside of try {} & catch() {} block, the exception is left uncaught. This, in PHP triggers a fatal error promptly terminating the execution of the script. Furthermore, if error displaying is enabled, which it is by default on most installs, all the exception information will be dumped to screen. This information happens to contain a code flow backtrace, which contains oodles of potentially sensitive information.

So here goes another reason for not passing serialized data via user accessible means and yet another demonstration why leaving “display_errors” in the ON position is a bad idea.

You know you're moving up in the world when Microsoft feels that it’s necessary to make cartoon disparaging your products, in favor of their own wares. Pierre, one of the PHP developers, has found this gem on the French segment of the Microsoft site. I guess it means that PHP is making enough in-roads into the Enterprise market, that big fish like MS feel it necessary to spread some FUD as a stop-gap measure.

Thanks to Sean Coates we now have an English translation available:
http://www.flickr.com/photos/12538148@N00/100864754/

The final (stable) release of FUDforum 2.7.4 is now available for download. This release is a culmination of several month of developed that have resulted in a series of new features as well as a resolution of fair number of bugs. All FUDforum users are encourages to upgrade to this release at their convenience. Code wise the release is virtually identical to 2.7.4RC2.
The upgrade and installation packages can be found here:

Upgrade Packages

Install Packages

My proposal for the php|tek 2006 conference have been approved, which means that I'll be flying to sunny Florida this spring. Given the gloomy weather here in Toronto, it certainly sounds like a lot of fun. On the conference's agenda I have just two items this time; I will be giving an introductory talk on PDO that should be of interest to anyone writing new PHP applications that utilize databases. The other item is a seminar on PHP Security, which will cover web security topics from the ground up, with the focus on web applications designed in PHP. Aside from my own talks, Marco has collected an impressive array of speakers with notables such as Rasmus, Marcus, Derick, John, Sara (who I've never met in real life ) and many others. So if you need to get away from the day to day drudgery and learn something about PHP in the process, this a conference you don't want to miss!

Chris has written a compelling piece about how the use of addslashes() for string escaping in MySQL queries can lead to SQL injection through the abuse of multibyte character sets. In his example he relies on addslashes() to convert an invalid multibyte sequence into a valid one, which also has an embedded ' that is not escaped. And in an ironic twist, the function intended to protect against SQL injection is used to actually trigger it.

The problem demonstrated, actually goes a bit further, which even makes the prescribed escaping mechanism, mysql_real_escape_string() prone to the same kind of issues affecting addslashes(). The main advantage of the mysql_real_escape_string() over addslashes() lies in the fact that it takes character set into account and thus is able to determine how to properly escape the data. For example, if GBK character set is being used, it will not convert an invalid multibyte sequence 0xbf27 (¿’) into 0xbf5c27 (¿\’ or in GBK a single valid multibyte character followed by a single quote). To determine the proper escaping methodology mysql_real_escape_string() needs to know the character set used, which is normally retrieved from the database connection cursor. Herein lies the “trick”. In MySQL there are two ways to change the character set, you can do it by changing in MySQL configuration file (my.cnf) by doing:



Or you can change on a per-connection basis, which is a common practice done by people without admin level access to the server via the following query:



The problem with the latter, is that while it most certainly modified the charset it didn’t let the escaping facilities know about it. Which means that mysql_real_escape_string() still works on the basis of the default charset, which if set to latin1 (common default) will make the function work in a manner identical to addslashes() for our purposes. Another word, 0xbf27 will be converted to 0xbf5c27 facilitating the SQL injection. Here is a brief proof of concept.



So what can you do? The solution is to use prepared statements, which are supported by nearly all PHP database extensions with the notable exceptions of MySQL (ext/mysql) and SQLite2 (ext/sqlite). So, to be on the safe side, I'd recommend using the PDO interface to talks with those databases or in the case of MySQL using the newer MySQLi (ext/mysqli) extension. Those interfaces provide prepared statement support, which allows for separation between query structure and the query parameters. It should be noted that while PDO does emulated prepared statements for older versions of MySQL that do not support them natively, emulation is still prone to the same kind of issues demonstrated here and in Chris’ article. Therefore for security reasons you should definitely consider upgrading to a more modern version of MySQL and SQLite (SQLite 3).

This morning I've released PHP 5.1.2 , which is a culmination of about 3 months work by PHP developer community. Big thanks to all the developers who have spent the time to make this release possible. This release combines some new features, a fair number of bug fixes and even addresses a few security bugs. If you are using PHP 5, this release is definitely worth upgrading to. The major changes can be found in the release announcement, while if you want to read the entire changelog, you can find it here.

Surprisingly enough unlike most PHP release this one was actually right one time and followed the release plan I've made to the letter, hopefully this is something we can keep up.

A little bit of trivia, PHP 5.1.2 is my 12th PHP release, which coincidentally was released on January the 12th

The second and final RC of 5.1.2 was packaged today and is now available for download. This has been a purely bug fix RC that addresses a number of crash bugs and does a bit of further tweaking on the date
functionality. Please test it as much as you can, since pending any major problems this becomes the final release on January 12th.

The sources can be downloaded from:
http://downloads.php.net/ilia/php-5.1.2RC2.tar.bz2
0a24a22552ae966afa3e0f3da2f1c47d

http://downloads.php.net/ilia/php-5.1.2RC2.tar.gz
7aee42982a8a16a0d600e1ef46dadec6

Win32 binaries should be available shortly from
http://downloads.php.net/ilia/ as well.

If you know of any regressions introduced by this release, please let me know.

Just finished packaging Fileinfo 1.0.3 that finally builds on both PHP 5.1 and 5.0 properly. You can download the new version by running "pecl install fileinfo" or download the tgz file from here.

I've also made the release of GDChart 0.2 that is nearly a complete rewrite of the extension, originally written by Rasmus that allows it to work with PHP 5.1. This extension wraps around the bundled gdchart library and allows you with just a few lines of code draw 20 different graphs types. Like all pecl extensions it can be installed by running "pecl install gdchart" or you can download the tar ball from here. Since at the moment there is no documentation for the extension, here are a few examples of its usage: Continue reading "GDChart & Fileinfo Releases"

I've just packaged PHP 5.1.2RC1, the first release candidate for the next 5.1 version. A small holiday present for all PHP users, from the the PHP developers . This is primarily a bug fixing release with its major points being:

* Many fixes to the strtotime() function, over 10 bugs have been resolved.
* A fair number of fixes to PDO and its drivers
* New OCI8 that fixes large number of bugs backported from head.
* A final fix for Apache 2 crash when SSI includes are being used.
* A number of crash fixes in extensions and core components.
* XMLwriter & Hash extensions were added and enabled by default.

The sources can be downloaded from:
http://downloads.php.net/ilia/php-5.1.2RC1.tar.bz2
df9e548b8c9275e510e25f2b3de2629c

http://downloads.php.net/ilia/php-5.1.2RC1.tar.gz
a2b3fd6e6115cee4bb8f5b3d5aeef66b

Win32 binaries should be available shortly from
http://downloads.php.net/ilia/ as well.

Following the “Release early, release often” mantra, PHP 5.1.1 was released today. The main causes for this release are four regressions in behavior introduces by PHP 5.1.0, which include:

• Native date class is withdrawn to prevent namespace conflict with PEAR's date package.


• Fixed fatal parse error when the last line of the script is a PHP comment.


• eval() hangs when the code being evaluated ends with a comment.


• Usage of \{$var} in PHP 5.1.0 resulted in the output of {$var} instead of the $var variable's value enclosed in {}.

The fifth reason being a refinement of a cURL open_basedir/safe_mode security fix, to improve the checks surrounding the file: wrapper handling. The new packages and win32 PECL binaries for PHP 5.1.1 can be found here: http://www.php.net/downloads.php

Now on to the long overdue rant

Continue reading "PHP 5.1.1 Released!"

Yes, it is true, PHP 5.1.0 is finally out!

The packages and win32 binaries are available at:
http://www.php.net/downloads.php

Some of the release highlights are:

• A complete rewrite of date handling code, with improved timezone support.
  
• Significant performance improvements compared to PHP 5.0.X.
  
• PDO extension is now enabled by default.
  
• Over 30 new functions in various extensions and built-in functionality.
  
• Bundled libraries, PCRE and SQLite upgraded to latest versions.
  
• Over 400 various bug fixes.
  
• PEAR upgraded to version 1.4.5
  
• 8 security fixes of varying "criticality"
  

The full changelog is here and the official release announcement can be viewed from http://www.php.net/release_5_1_0.php

A few days ago I received an e-mail confirming acceptance of my talks for annual PHP Conference in Montreal, yippee! Going to speak in Montreal is always fun, the organizers always find something entertaining for us to do. PHP Québec also holds very fond memories for me, being the first PHP conference I had a chance to speak at back in 2003, and 2006 will be the 4th year in a row speaking there. I guess they haven’t grown tired of me just yet

At the conference I will be giving a single talk on PDO as part of the database track and doing a workshop on PHP security. I hope to make both of those as informative and entertaining possible, so if those topics hold your interest, be sure to attend.

You can find additional details about the conference on the PHP Québec website.