Geo. wrote:
That's a rather odd question. Microsoft has been (rightly) criticized for providing server *applications* that are insecurely configured (as you point out), but php is not an application. Php is a language, so until a program or script is written and accessible from the server, it does nothing. Php, by itself, is not accessible externally because it's not running a daemon that opens a port...."The configuration flexibility of PHP is equally rivalled by the code flexibility. PHP can be used to build complete server applications, with all the power of a shell user, or it can be used for simple server-side includes with little risk in a tightly controlled environment. How you build that environment, and how secure it is, is largely up to the PHP developer."And is the default install wide open or tightly controlled? I mean from a security standpoint we have been screaming for years at Microsoft to change their defaults to firewall on and things locked instead of open. Is php secure by default when it's installed on a server?
Register_globals is set to off by default, so I suppose in that sense you can say it's "secure" by default, but it's really a inert object until someone does something with it.
Any language can be misused to create insecure software. The more powerful the language, the less difficult it is to create security holes (or perhaps the more obvious the holes really are.) But until an attacker has an open port to attack (unless they're sitting at the console), everything on a server is "secure". (Of course the server is also useless, but that's beside the point.)
-- Paul Schmehl (pauls@xxxxxxxxxxxx) Adjunct Information Security Officer The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature