Re: [nyphp-talk] Hash Table Vulnerability in PHP5

2011-12-29 Thread Ben Sgro
s! > > Hans Kaspersetz > Cyber X Designs > http://cyberxdesigns.com > > > From: [email protected] [mailto:[email protected]] On > Behalf Of Ben Sgro > Sent: Thursday, December 29, 2011 11:33 AM > To: NYPHP Talk > Subject: Re: [nyphp-ta

Re: [nyphp-talk] Hash Table Vulnerability in PHP5

2011-12-29 Thread Hans C. Kaspersetz
AM To: NYPHP Talk Subject: Re: [nyphp-talk] Hash Table Vulnerability in PHP5 Hey, Don't allow posts w/> ~100 k/v pairs. Don't allow larger uploads then is necessary. As you mentioned, I guess limit script execution time. Right now, there's some snort signatures going a

Re: [nyphp-talk] Hash Table Vulnerability in PHP5

2011-12-29 Thread Ben Sgro
Hey, Don't allow posts w/> ~100 k/v pairs. Don't allow larger uploads then is necessary. As you mentioned, I guess limit script execution time. Right now, there's some snort signatures going around (Not sure if you run IDS, etc). I've also heard people mention a mod_rewrite regex to strip out t

[nyphp-talk] Hash Table Vulnerability in PHP5

2011-12-29 Thread Hans C. Kaspersetz
Good morning, I hope everyone has seen the news about the Hash Table Vulnerability in lots of web scripting languages. You can read about it here: http://www.securityweek.com/hash-table-collision-attacks-could-trigger-ddos- massive-scale or here http://www.kb.cert.org/vuls/id/903934. It lo