Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13355 > unrolled thread

Heartbleed bug?

Back to article view | Back to comp.lang.php

Contents

  Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
    Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
      Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
        Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
          Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
            Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
              Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
                  Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
                    Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
                    Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
                      Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
                        Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
                        Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
                          Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
                            Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
                            Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
                  Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
                    Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
                      Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
          Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
            Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
              Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
            Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
    Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
      Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
      Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
        Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
          Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
          Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
            Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
            Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
              Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
    Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
      Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200

Page 2 of 2 — ← Prev page 1 [2]

#13374

On Thu, 10 Apr 2014 08:51:23 +0200, Arno Welzel wrote:

> I assume PHP does keep up with the latest release because they *are*
> affected by the bug e.g. in stream_socket_enable_crypto().

Only like to be an issue if you've been writing your own ssl transport in 
php, which would beg the question why on earth did you do that?

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#13360

At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:

> 
> On 4/9/2014 9:56 AM, Robert Heller wrote:
> > At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
> >
> >>
> >> On 4/9/2014 8:24 AM, Kevin Burton wrote:
> >>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension is enabled? Is there a patch for the extension?
> >>>
> >>
> >> You need to be asking the OpenSSL people what products their bug affects.
> >
> > Since this is a shared library on a typical Linux system (eg LAMP server), it
> > will affect any program that links with OpenSSL's library(-ies).  I know that
> > at least the CentOS user group is talking about it and I am sure RedHat is
> > also looking at it.  (A large number of LAMP servers run CentOS.)
> >
> >>
> >
> 
> That may or may not be.  It depends on exactly what the problem is - or 
> exactly what it affects.  From the description on the website, I can't 
> tell.  Can you?
> 
> Obviously, though, those who know the code would know exactly what it 
> affects.
> 
> A bug in a program does not necessarily affect everything that touches 
> that program!

According to the CentOS mailing list, a patched version of the openssl 
libraries was released yesterday.  Only one version of CentOS (and I guess 
RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one 
also needs to remake certificates (with new private keys!) and revoke the old 
ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case 
(deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my 
understanding that a *large* number of LAMP webservers are running some 
version of CentOS.  I presume that the system admins of the affected systems
are on the CentOS mailing list and are on top of things.

> 
> 

-- 
Robert Heller             -- 978-544-6933 / heller@deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments


                                                                                

[toc] | [prev] | [next] | [standalone]

#13362

On 4/9/2014 11:56 AM, Robert Heller wrote:
> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>
>>
>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>
>>>>
>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension is enabled? Is there a patch for the extension?
>>>>>
>>>>
>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>
>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>
>>>>
>>>
>>
>> That may or may not be.  It depends on exactly what the problem is - or
>> exactly what it affects.  From the description on the website, I can't
>> tell.  Can you?
>>
>> Obviously, though, those who know the code would know exactly what it
>> affects.
>>
>> A bug in a program does not necessarily affect everything that touches
>> that program!
>
> According to the CentOS mailing list, a patched version of the openssl
> libraries was released yesterday.  Only one version of CentOS (and I guess
> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
> also needs to remake certificates (with new private keys!) and revoke the old
> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
> understanding that a *large* number of LAMP webservers are running some
> version of CentOS.  I presume that the system admins of the affected systems
> are on the CentOS mailing list and are on top of things.
>
>>
>>
>

That may be.  But it still doesn't answer your original question as to 
how (or even if) it affects PHP.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#13364

Am 09.04.2014 19:38, schrieb Jerry Stuckle:
> On 4/9/2014 11:56 AM, Robert Heller wrote:
>> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>
>>>
>>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>>
>>>>>
>>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension
>>>>>> is enabled? Is there a patch for the extension?
>>>>>>
>>>>>
>>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>>
>>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>>
>>>>>
>>>>
>>>
>>> That may or may not be.  It depends on exactly what the problem is - or
>>> exactly what it affects.  From the description on the website, I can't
>>> tell.  Can you?
>>>
>>> Obviously, though, those who know the code would know exactly what it
>>> affects.
>>>
>>> A bug in a program does not necessarily affect everything that touches
>>> that program!
>>
>> According to the CentOS mailing list, a patched version of the openssl
>> libraries was released yesterday.  Only one version of CentOS (and I guess
>> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
>> also needs to remake certificates (with new private keys!) and revoke the old
>> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
>> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
>> understanding that a *large* number of LAMP webservers are running some
>> version of CentOS.  I presume that the system admins of the affected systems
>> are on the CentOS mailing list and are on top of things.
>>
>>>
>>>
>>
> 
> That may be.  But it still doesn't answer your original question as to how (or even
> if) it affects PHP.
> 

In german we call this "bug" a "GAU", that means "Maximum Credible Accident". You'd
better *make sure* you are not affected. Starting point: you are.

There seem to be "just a few versions" of openssl affected, but for those who are it
is a GAU.

/Str.

[toc] | [prev] | [next] | [standalone]

#13371

On 4/9/2014 6:11 PM, M. Strobel wrote:
> Am 09.04.2014 19:38, schrieb Jerry Stuckle:
>> On 4/9/2014 11:56 AM, Robert Heller wrote:
>>> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>
>>>>
>>>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>>>
>>>>>>
>>>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension
>>>>>>> is enabled? Is there a patch for the extension?
>>>>>>>
>>>>>>
>>>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>>>
>>>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>>>
>>>>>>
>>>>>
>>>>
>>>> That may or may not be.  It depends on exactly what the problem is - or
>>>> exactly what it affects.  From the description on the website, I can't
>>>> tell.  Can you?
>>>>
>>>> Obviously, though, those who know the code would know exactly what it
>>>> affects.
>>>>
>>>> A bug in a program does not necessarily affect everything that touches
>>>> that program!
>>>
>>> According to the CentOS mailing list, a patched version of the openssl
>>> libraries was released yesterday.  Only one version of CentOS (and I guess
>>> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
>>> also needs to remake certificates (with new private keys!) and revoke the old
>>> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
>>> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
>>> understanding that a *large* number of LAMP webservers are running some
>>> version of CentOS.  I presume that the system admins of the affected systems
>>> are on the CentOS mailing list and are on top of things.
>>>
>>>>
>>>>
>>>
>>
>> That may be.  But it still doesn't answer your original question as to how (or even
>> if) it affects PHP.
>>
>
> In german we call this "bug" a "GAU", that means "Maximum Credible Accident". You'd
> better *make sure* you are not affected. Starting point: you are.
>
> There seem to be "just a few versions" of openssl affected, but for those who are it
> is a GAU.
>
> /Str.
>

How do you know I am affected?  Do you know my code?  What PHP functions 
it affects?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#13363

On 09/04/14 16:56, Robert Heller wrote:
> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>
>>
>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>
>>>>
>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension is enabled? Is there a patch for the extension?
>>>>>
>>>>
>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>
>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>
>>>>
>>>
>>
>> That may or may not be.  It depends on exactly what the problem is - or
>> exactly what it affects.  From the description on the website, I can't
>> tell.  Can you?
>>
>> Obviously, though, those who know the code would know exactly what it
>> affects.
>>
>> A bug in a program does not necessarily affect everything that touches
>> that program!
>
> According to the CentOS mailing list, a patched version of the openssl
> libraries was released yesterday.  Only one version of CentOS (and I guess
> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
> also needs to remake certificates (with new private keys!) and revoke the old
> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
> understanding that a *large* number of LAMP webservers are running some
> version of CentOS.  I presume that the system admins of the affected systems
> are on the CentOS mailing list and are on top of things.
>
>>
>>
>
I've seen and installed SSL updates on the mint<-Ubuntu<-debian tree 
yesterday


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13365

On Wed, 09 Apr 2014 05:24:02 -0700, Kevin Burton wrote:
> Anyone know how this bug http://heartbleed.com/ affects PHP when the
> extension is enabled? Is there a patch for the extension?

OpenSSL has released version 1.0.1g to fix the Heartbleed bug. Non-
Windows users generally don't need to update their PHP installation; 
upgrading OpenSSL to a fixed version is sufficient. (All major Linux 
distributions have now shipped OpenSSL updates.) The Windows PHP packages 
distributed from windows.php.net _do_ include a local copy of OpenSSL, 
and have been rebuilt today to include 1.0.1g: if you're using a package 
from windows.php.net, you should upgrade immediately.

Once you've upgraded OpenSSL, restart your Web server, PHP-FPM if you're 
using it, and any other PHP processes you have running.

Note that you may need to take additional action, depending on whether 
you fit into one (or more) of the following categories:

1. You're running a HTTPS server.

If you're running a Web server that uses OpenSSL to provide SSL/TLS (eg 
Apache, nginx, lighttpd), you'll need to upgrade OpenSSL, restart your 
Web server, _and_ revoke your SSL certificates and have them reissued 
with new private keys. (This last step is due to the nature of the bug: 
it's possible for an attacker to have already captured your private key, 
and even if you upgrade OpenSSL, they could then use that to decrypt your 
secure traffic.)

You should probably suggest to your users that they change their 
passwords as well, since it may have been possible for attackers to 
extract those opportunistically from your PHP process's memory, 
particularly if you're using something like mod_php where the SSL/TLS 
negotiation happens in the same process as PHP is executed in.

2. You're connecting to secure servers from within PHP _and_ using client
   certificates.

This is extremely rare (if you don't know whether you're using client 
certificates, you're not), but if you have code that sets the 
CURLOPT_SSLCERT option or the SSL local_cert context option, you'll want 
to revoke and reissue your client certificate(s) with new private keys 
once you've upgraded OpenSSL.

3. You wrote a secure socket server _in_ PHP. (My God, why?)

It's possible to write a secure socket server in PHP by using 
stream_socket_server() with the ssl:// or tls:// protocol. If so, the fix 
is similar to the first case: upgrade OpenSSL, restart all PHP processes, 
and create new server certificates using new private keys.

Adam

[toc] | [prev] | [next] | [standalone]

#13366

In comp.lang.php, Adam Harvey  <usenet@adamharvey.name> wrote:
> Note that you may need to take additional action, depending on whether 
> you fit into one (or more) of the following categories:
...
> 3. You wrote a secure socket server _in_ PHP. (My God, why?)

https://duckduckgo.com/?q=mtgox+php+ssh

Elijah
------
but you knew that already, right?

[toc] | [prev] | [next] | [standalone]

#13367

Kevin Burton, 2014-04-09 14:24:

> Anyone know how this bug http://heartbleed.com/ affects PHP when the
> extension is enabled? Is there a patch for the extension?

This bug has nothing to do with PHP at all - it affects OpenSSL and all
services depending on ot (Apache, Nginx, Mailservers etc.).


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#13369

Arno Welzel, 2014-04-10 08:43:

> Kevin Burton, 2014-04-09 14:24:
> 
>> Anyone know how this bug http://heartbleed.com/ affects PHP when the
>> extension is enabled? Is there a patch for the extension?
> 
> This bug has nothing to do with PHP at all - it affects OpenSSL and all
> services depending on ot (Apache, Nginx, Mailservers etc.).

To be precise: If the installed PHP version is linked against OpenSSL
then it should be replaced with a patched version of course.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#13375

On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:

> To be precise: If the installed PHP version is linked against OpenSSL
> then it should be replaced with a patched version of course.

Is simply being linked against the buggy openssl enough to be 
exploitable? As I understand it the openssl code needs to be invoked (eg 
https) for the bug to actually expose data.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#13378

On 10/04/14 16:50, Denis McMahon wrote:
> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
>
>> To be precise: If the installed PHP version is linked against OpenSSL
>> then it should be replaced with a patched version of course.
>
> Is simply being linked against the buggy openssl enough to be
> exploitable? As I understand it the openssl code needs to be invoked (eg
> https) for the bug to actually expose data.
>

well yes. A library you never use cant be exploited for flaws in it.

What you need is that you are providing an SSL service via a buggy SSL 
library: then certain types of signal sent to it will get 'interesting' 
responses in reply..




-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13380

Denis McMahon, 2014-04-10 17:50:

> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
> 
>> To be precise: If the installed PHP version is linked against OpenSSL
>> then it should be replaced with a patched version of course.
> 
> Is simply being linked against the buggy openssl enough to be 
> exploitable? As I understand it the openssl code needs to be invoked (eg 

No. The bug is only exploitable if you run a SSL/TLS server - which is
possible using PHP.

> https) for the bug to actually expose data.

I don't know what exactly you do with your code. But the opposite -
"it's just PHP, nothing to worry about any library bugs" - is also not
the right way to deal with security problems.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#13381

Am 10.04.2014 22:56, schrieb Arno Welzel:
> Denis McMahon, 2014-04-10 17:50:
> 
>> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
>>
>>> To be precise: If the installed PHP version is linked against OpenSSL
>>> then it should be replaced with a patched version of course.
>>
>> Is simply being linked against the buggy openssl enough to be 
>> exploitable? As I understand it the openssl code needs to be invoked (eg 
> 
> No. The bug is only exploitable if you run a SSL/TLS server - which is
> possible using PHP.
> 

As I read on stackoverflow, the client is vulnerable as well. So if you start a ssl
secured connection, you can be attacked by the partner.

Evidently this is "less dangerous" than the case of a server offering SSL secured
services.

/Str.

[toc] | [prev] | [next] | [standalone]

#13384

On Thu, 10 Apr 2014 22:56:34 +0200, Arno Welzel wrote:

> Denis McMahon, 2014-04-10 17:50:
> 
>> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
>> 
>>> To be precise: If the installed PHP version is linked against OpenSSL
>>> then it should be replaced with a patched version of course.
>> 
>> Is simply being linked against the buggy openssl enough to be
>> exploitable? As I understand it the openssl code needs to be invoked
>> (eg
> 
> No. The bug is only exploitable if you run a SSL/TLS server - which is
> possible using PHP.
> 
>> https) for the bug to actually expose data.

Sorry, but you seem to be saying "No" and then agreeing with me. Perhaps 
it's the way you have quote-replied, and I'm reading your "No" as 
applying to a different part of the quoted text to that which you 
intended it to refer?

Are you saying "No" to the question:

>> Is simply being linked against the buggy openssl enough to be
>> exploitable? 

Or the statement:

>> As I understand it the openssl code needs to be invoked
>> (eg https) for the bug to actually expose data.

Because I can't tell from the way you quoted me which of these you're 
saying no to, and depending which applies, you're either agreeing with my 
position or disputing it.

> "it's just PHP, nothing to worry about any library bugs" - is also not
> the right way to deal with security problems.

That's not what I'm saying. What I am saying is that as I understand it, 
in this specific case, you only have a php issue if your php code is 
making ssl / tsl connections using the vulnerable OpenSSL library, and 
that is something that the admin and / or coders responsible for a system 
needs to determine for themselves given their knowledge of what their 
system does.

I don't know enough about your code, Jerry's code, or anyone elses code 
(except maybe richard's[1], we all know too much about richard's code) to 
determine whether that person's php code is vulnerable to this exploit.

[1] I doubt richard's code is vulnerable to this exploit, the universe's 
life expectancy is insufficient for him to develop the coding competency 
required to implement a server process in php.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#13390

Denis McMahon, 2014-04-11 01:14:

> On Thu, 10 Apr 2014 22:56:34 +0200, Arno Welzel wrote:
> 
>> Denis McMahon, 2014-04-10 17:50:
>>
>>> On Thu, 10 Apr 2014 08:57:54 +0200, Arno Welzel wrote:
>>>
>>>> To be precise: If the installed PHP version is linked against OpenSSL
>>>> then it should be replaced with a patched version of course.
>>>
>>> Is simply being linked against the buggy openssl enough to be
>>> exploitable? As I understand it the openssl code needs to be invoked
>>> (eg
>>
>> No. The bug is only exploitable if you run a SSL/TLS server - which is
>> possible using PHP.
>>
>>> https) for the bug to actually expose data.
> 
> Sorry, but you seem to be saying "No" and then agreeing with me. Perhaps 
> it's the way you have quote-replied, and I'm reading your "No" as 
> applying to a different part of the quoted text to that which you 
> intended it to refer?

Sorry for the confusion :-(

> Are you saying "No" to the question:
> 
>>> Is simply being linked against the buggy openssl enough to be
>>> exploitable? 

Yes - this I am referring to. Just the fact that you use a PHP version
which is linket to a buggy OpenSSL lib is of course not enough to
exploit the bug. One has to actually *use* the buggy functions in a way
that an attacker can send crafted heartbeat packets to your server.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#13373

On Wed, 09 Apr 2014 05:24:02 -0700, Kevin Burton wrote:

> Anyone know how this bug http://heartbleed.com/ affects PHP when the
> extension is enabled? Is there a patch for the extension?

My understanding of heartbleed is that it potentially exposes data 
transferred over ssl encrypted links. As php generally[1] doesn't 
implement ssl communication itself it probably doesn't affect core php a 
great deal, but if you wrote php code using ssl functions eg http://
www.php.net/manual/en/ref.openssl.php you might have some exposure to 
worry about.

[1] Not sure what curl does for ssl, but on a compromised platform, I 
imagine it's possible that data passed over https using curl or similar 
methods might also have been compromised.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#13392

Am 10.04.2014 17:42, schrieb Denis McMahon:
> On Wed, 09 Apr 2014 05:24:02 -0700, Kevin Burton wrote:
> 
>> Anyone know how this bug http://heartbleed.com/ affects PHP when the
>> extension is enabled? Is there a patch for the extension?
> 
> My understanding of heartbleed is that it potentially exposes data 
> transferred over ssl encrypted links. As php generally[1] doesn't 
[...]

No - heartbleed means a server will send everybody some data when asked.

This may help to understand it:

<http://xkcd.com/1354/>


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web