APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

Security begins at home

© April 2005 Tony Lawrence

Author: TonyLawrence

Yesterday there was another PHP security flaw announced: PHP falls down security hole

I don't mean to belittle the importance of this, but this and even most reported exploits are conditional things and not necessarily something you need to jump on to correct. In this particular case, the reported problems have to do with uploading images. If your php website doesn't have a function that allows users to upload images, this flaw doesn't affect you.

Very often, reported flaws depend upon specific situations. Sometimes it's very obvious: if you don't allow port 23 inward to your systems, you don't have to worry about telnet security flaws except perhaps from local users. But often you have to dig through a lot of detail to figure out just how the flaw would be exploited, and even then it's not always easy for a non-technical user to figure out. It's not always particularly easy for a fairly tech savvy user either.

Let's take a hypothetical case of a new security flaw discovered in the sshd package. Remember, this is hypothetical, a made up case: don't go looking for a patch. We'll pretend that this is a problem that is reported as allowing root login without a password. That would be pretty scary stuff, right?

OK, but your sshd servers are configured not to accept anything but public key authentication so ordinarily nobody but the specific sites you allow can ever login - at least not without someone stealing keys. So does this flaw affect you? Maybe, maybe not, but I bet you'd have a hard time finding out. Although this is a hypothetical case, I've had similar situations in the past where I just wasn't sure if a reported exploit had anything to do with my specific situation.

You might say "so just patch it - be certain". Yes, of course. But that can take time, and that's particularly true when the report affects multiple machines. Fixing the problem can consume more time than you would like to give it right now, and of course can also mean interruption of service for users, maybe even rebooting and sometimes major changes in other applications that depend upon some feature that now has to work slightly differently. In other words, it can be a big sticky mess, so it may be worth the effort to determine if the reported exploit really does affect you.

This particular PHP problem doesn't affect me, so I can safely ignore it. I wish I could say the same for every security flaw.

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> Security begins at home

Inexpensive and informative Apple related e-books:

Sierra: A Take Control Crash Course

Take Control of iCloud, Fifth Edition

Take Control of Parallels Desktop 12

Take control of Apple TV, Second Edition

Take Control of Automating Your Mac

More Articles by © Tony Lawrence

Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

If you lie to the computer, it will get you. (Perry Farrar)

Linux posts

Troubleshooting posts

This post tagged:


Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode