Re: Exec Security

Path	csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!de-l.enfer-du-nord.net!feeder2.enfer-du-nord.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php
Subject	Re: Exec Security
Date	Mon, 03 Sep 2012 06:55:09 +0200
Lines	20
Message-ID	<aairheF434U1@mid.individual.net> (permalink)
References	<70901dbf-84a0-475d-a287-6fe420963592@googlegroups.com> <b94dded5-3893-4f01-9fcc-d485f22d2217@googlegroups.com> <aae9amFm0eU1@mid.individual.net> <6eb65973-56a8-45f6-8ed7-9a4cc088f35d@googlegroups.com> <0c1f42c4-672a-48ad-991c-3424e3e0902d@googlegroups.com> <k1tr24$85r$1@dont-email.me> <754fd56a-7fdd-4bab-983f-92873ac60111@googlegroups.com> <k1u4sl$4h4$1@dont-email.me> <8d2e25ff-acb0-4224-bb40-8d078409d771@googlegroups.com> <aagfvjF1r0U2@mid.individual.net> <58ce539e-4061-47b7-a024-9ef09811513f@googlegroups.com> <4e02c3d0-efaa-4b1d-a9f3-3f4a92faab6b@googlegroups.com> <k2190s$lai$1@dont-email.me> <1a6f53bc-8f81-42d3-827b-9e5f8f158a79@googlegroups.com>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	individual.net xsY1JLy+WQ10MwUjqLvmTAB88AZAxTk4VX/teSbNtRRQHq4NxlK+3kGF6VnX5dFTJD
Cancel-Lock	sha1:Sxp0090ms7v45F+/69eIDHwByq8=
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120613 Firefox/12.0 SeaMonkey/2.9.1
In-Reply-To	<1a6f53bc-8f81-42d3-827b-9e5f8f158a79@googlegroups.com>
Xref	csiph.com comp.lang.php:6938

Show key headers only | View raw

Ryan wrote:

> IMO I see no security issue with exec() in this setup. The command in exec() is hardcoded, not using any user inputs.
> Someone would have to find a way to write their own php script to use exec() and get it uploaded into my vhost to cause any problems.
> If they can manage to do that that can cause enough issues even with exec() disabled.

I have seen quite many times when a host with exec enabled and user code don't 
have any exec calls, where a someone managed to use trigger eval and then 
executed exec. I see both exec (and similar) and eval as no no in a web 
server. There will always come a day when you want to add something more and 
suddenly you have something that will allow things to go wrong, I think it's 
better to do a more solid solution from start, even if it takes more work, no 
matter if you do use a database or a message queue.

But it's your system, so you decide how you want to do things.

-- 

   //Aho

Thread

Exec Security Ryan <rbilesky@gmail.com> - 2012-08-31 18:49 -0700
  Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-08-31 22:12 -0400
  Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 08:54 +0200
  Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 02:51 -0700
    Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 13:19 +0200
      Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 11:50 -0700
        Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 13:19 -0700
          Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 16:26 -0400
            Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 14:11 -0700
              Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-01 19:14 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-01 17:17 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-02 09:25 +0200
                Re: Exec Security The Natural Philosopher <tnp@invalid.invalid> - 2012-09-02 12:02 +0100
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:32 -0700
                Re: Exec Security Jerry Stuckle <jstucklex@attglobal.net> - 2012-09-02 23:43 -0400
                Re: Exec Security Ryan <rbilesky@gmail.com> - 2012-09-02 20:53 -0700
                Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-03 06:55 +0200
        Re: Exec Security "J.O. Aho" <user@example.net> - 2012-09-01 23:23 +0200

csiph-web