Re: Exec Security

From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Exec Security
Date	2012-09-03 06:55 +0200
Message-ID	<aairheF434U1@mid.individual.net> (permalink)
References	(9 earlier) <aagfvjF1r0U2@mid.individual.net> <58ce539e-4061-47b7-a024-9ef09811513f@googlegroups.com> <4e02c3d0-efaa-4b1d-a9f3-3f4a92faab6b@googlegroups.com> <k2190s$lai$1@dont-email.me> <1a6f53bc-8f81-42d3-827b-9e5f8f158a79@googlegroups.com>

Show all headers | View raw

Ryan wrote:

> IMO I see no security issue with exec() in this setup. The command in exec() is hardcoded, not using any user inputs.
> Someone would have to find a way to write their own php script to use exec() and get it uploaded into my vhost to cause any problems.
> If they can manage to do that that can cause enough issues even with exec() disabled.

I have seen quite many times when a host with exec enabled and user code don't 
have any exec calls, where a someone managed to use trigger eval and then 
executed exec. I see both exec (and similar) and eval as no no in a web 
server. There will always come a day when you want to add something more and 
suddenly you have something that will allow things to go wrong, I think it's 
better to do a more solid solution from start, even if it takes more work, no 
matter if you do use a database or a message queue.

But it's your system, so you decide how you want to do things.

-- 

   //Aho

Thread

Exec Security Ryan <rbilesky@gmail.com> - 2012-08-31 18:49 -0700
  Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-08-31 22:12 -0400
  Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 08:54 +0200
  Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 02:51 -0700
    Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 13:19 +0200
      Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 11:50 -0700
        Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 13:19 -0700
          Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 16:26 -0400
            Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 14:11 -0700
              Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 19:14 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 17:17 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-02 09:25 +0200
                Re: Exec Security The Natural Philosopher <tnp@invalid.invalid> - 2012-09-02 12:02 +0100
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:32 -0700
                Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-02 23:43 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:53 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-03 06:55 +0200
        Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 23:23 +0200

csiph-web