Various Applications Affected

Various Applications Affected

from: newsfactor.com

Web servers running Apache, Microsoft's Internet Information Server, Netscape, iPlanet and OmniHTTPd are among those affected.

The security firms pointed to Linux and Solaris operating systems as the two platforms most at risk, although other operating systems also can run the PHP language.

Jim Hurley, vice president for security and privacy at Aberdeen Group, told NewsFactor that those running Linux are most at risk.

"For anybody that has Linux out there, most likely you've got PHP in the environment. And if it's accessible, it could be accessed by anybody and could lead to problems of ownership over the machine," said Hurley.

Compared with Web servers running Microsoft IIS or Mac OS X, Hurley said he believes the Linux group will spend the most time installing patches and upgrades.

SNMP Security Flaw

Another recent major security hole was found earlier this month by CERT.

The SNMP networking protocol, or Simple Network Management Protocol, a method of monitoring and managing network devices used by dozens of hardware makers and Internet service providers, was found to have security flaws that make devices using the protocol susceptible to hackers.

In that case, the security alert extended beyond university and commercial networks as security experts warned consumers of the danger that computers, scanners, printers and other devices hooked up to a network could face. They urged consumers to apply all relevant patches and upgrades to solve the problem.

Common, Uncommon Elements

Giga's Hunt explained that the SNMP and PHP security holes have one thing in common. "Their similarity is in the ease of their fix," he said, noting that required patches and upgrades are readily available.

Hurley noted that while SNMP is more pervasive than PHP, its flaw was less threatening because networks using it in an enterprise environment generally are located behind protective firewalls.

"PHP provides anyone on the Internet with access to the Web server, and therefore to anything else within the firewalls," Hurley said.

Microsoft (Nasdaq: MSFT), Cisco (Nasdaq: CSCO), Netscape, Nokia, Lucent (NYSE: LU), Hewlett-Packard (NYSE: HWP), Novell (Nasdaq: NOVL) and Lotus were among the companies named by CERT as having software that could be affected by the SNMP security flaw.

<<Back>>

Other Related Links