PHP version check about iniscan HOT 9 CLOSED

As in "you're using PHP X and we know about these 5 issues patched since then" kind of thing?

from iniscan.

That's the idea. There is now version switching in the code and the idea of
ini scanning is to secure the current environment based on its
configuration. And your version is part of that configuration.
On 07 Dec 2013 12:06 AM, "Chris Cornutt" [email protected] wrote:

As in "you're using PHP X and we know about these 5 issues patched since
then" kind of thing?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/59#issuecomment-30033687
.

from iniscan.

Here's a gist concept: https://gist.github.com/xsist10/7878272

from iniscan.

Hmm, I wonder if this would be better as a "vulnerability check" kind of command rather than just the regular scan command especially since not all of the CVEs are related directly to ini settings.

I do wonder if this might be stretching things a bit too far though...

from iniscan.

Tthere aren't any tools out there to inform you of your PHP version vulnerabilities (beyond running something like sudo apt-get upgrade php5 in Ubuntu/Debian). Since a lot of production environments tend to stick to stable versions and update infrequently, the versions can get out of date quite quickly.

I agree with having a separate command for it.

from iniscan.

I'm on the fence about this - it almost seems like it could be a separate tool rather than trying to get it into this one. Thoughts?

from iniscan.

Well what is the objective of the tool?

1. Ensure that your PHP environment is following best security practices.

Then it should be included. It could mean adding things like this as well:

• Process owner for web execution (not running script execution as root)
• PHP Extension versions and vulnerabilities
• Is Suhoshin installed?

2. Or ensure that your php.ini configuration ONLY is following best security practices.

Then probably not.

Just FYI, I've been looking around and I can't find a single non-OS/distro specific tool that will tell you if your PHP version is vulnerable. The only tools out there are software updaters for distros like Ubuntu/Debian/etc (which are not always accessable to the developer). I definitely see a need for a portable PHP tool that can fill this hole.

from iniscan.

I think it's probably best to split it off so I start this one up:
https://github.com/psecio/versionscan

from iniscan.

closing this off since the other project is up and going.

from iniscan.