<?xml version="1.0"?>
<rss version="2.0">
  <channel>
    <title>PHPDeveloper.org</title>
    <link>http://www.phpdeveloper.org</link>
    <description>Up-to-the Minute PHP News, views and community</description>
    <language>en-us</language>
    <pubDate>Wed, 19 Jun 2013 22:29:29 -0500</pubDate>
    <ttl>30</ttl>
    <item>
      <title><![CDATA[Stefan Esser's Blog: Suhosin 0.9.20 and crypt() Thread Safety Vulnerability]]></title>
      <guid>http://www.phpdeveloper.org/news/7891</guid>
      <link>http://www.phpdeveloper.org/news/7891</link>
      <description><![CDATA[<p>
<i>Stefan Esser</i> <a href="http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html">points out</a> the latest release of his PHP security enhancement patch, <A href="http://www.suhosin.org/">Suhosin 0.9.20</a>, and some of the features it adds, a major one specifically.
</p>
<blockquote>
The most important addition is that a mutex is placed around the call to the system's crypt() function to ensure thread safety. This mutex is necessary to close a bunch of possible attacks on the libc crypt() function on multi threaded systems.
</blockquote>
<p>
He goes on to explain why it's so important - correcting a possible race condition between competing threads looking to use the crypt() function at the same time. They use the same shared memory space and, because of this, can return possible invalid data. The patch changes this behavior and replaces it with a blowfish implementation to make things more thread-safe.
</p>]]></description>
      <pubDate>Tue, 22 May 2007 08:34:00 -0500</pubDate>
    </item>
  </channel>
</rss>
