Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: Heartbleed bug? Date: Fri, 11 Apr 2014 08:33:19 +0200 Lines: 48 Message-ID: <53478CAF.70108@arnowelzel.de> References: <38941292-a3a7-4dc0-ba31-873351d81924@googlegroups.com> <53456ab0$0$6618$9b4e6d93@newsspool4.arcor-online.net> <53463F6B.5010406@arnowelzel.de> <534704E9.9050904@arnowelzel.de> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net sVyiqAgCd0YE3kNve7vu0gwIYdOel7FbaTXxRgv3mtEAktFCUI Cancel-Lock: sha1:NoR0FZn3MHYUVeZErYSaCwNuGaY= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 In-Reply-To: X-Enigmail-Version: 1.6 Xref: csiph.com comp.lang.php:13391 Denis McMahon, 2014-04-11 00:45: > On Thu, 10 Apr 2014 22:54:01 +0200, Arno Welzel wrote: > >> The fact is, that stream_socket_enable_crypto() allows to build a server >> which listens on a socket to accept incoming SSL/TLS connections and >> uses OpenSSL for this. >> >> OpenSSL up to 1.0.1f has a now well known vulnerability for that use >> case. >> >> Ask who ever you want. If you got the answers that prove all this wrong, >> do the rest of us a favour and tell us. > > Yes, but for that issue to affect your (or my, or Jerry's) code, we'd > have had to write our own SSL/TLS enabled server in PHP. > > And for that issue to affect anyone elses code, they'd have had to write > their own SSL/TLS enabled server in PHP. > > So this comes back to: The "heartbleed" exploit will only affect your php > code if your php code is linked against the exploitable OpenSSL libraries > *AND* your code calls functions in those libraries that expose the > exploits. That's correct. > And to know that you need to know which functions of the libraries are > exploitable, and whether your code calls those functions. It's impossible > for anyone, without reviewing another persons code, to tell whether that > other person's code is exposed to this exploit or not, and that is the > point that I believe Jerry is trying to make, and that you are so > abstrusely refusing to recognise. Of course not *every* PHP based application is affected by the OpenSSL bug. But I refuse to assume the opposite that everything is OK as long as no one exactly can describe, how the OpenSSL bug may affect PHP applications. Because concerning PHP in general there *is* a problem which *can* affect PHP based applications as long as you use a PHP version without updated OpenSSL libraries. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de http://fahrradzukunft.de