#30892 [NEW]: expose_php *is* effectively a security threat

From: mark_php at stewards dot telinco dot co dot uk Operating system: Windows XP SP2 PHP version: 5.0.2 PHP Bug Type: PHP options/info functions Bug description: expose_php *is* effectively a security threat Description: ------------ A very minor issue - I think the wording could be more informative, given today's apathy for updating. expose_php *can be* a security threat if the user doesn't keep PHP up-to-date. Hiding it doesn't make a server more secure, but will protect from large-scale sweeps, and I've seen it used as an excuse not to update. On the other hand, it stops the considerate people noticing (not really a factor for a sensible admin) and breaks web-software surveys. I'd suggest changing it to something like "It is not a security threat on its own", and adding "Do not remove this to hide the fact that you don't update - join the PHP announcements list.". Reproduce code: --------------- ; ; Misc ; ; Decides whether PHP may expose the fact that it is installed on the server ; (e.g. by adding its signature to the Web server header). It is no security ; threat in any way, but it makes it possible to determine whether you use PHP ; on your server or not. expose_php = On -- Edit bug report at http://bugs.php.net/?id=30892&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=30892&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30892&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30892&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=30892&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=30892&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=30892&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=30892&r=needscript Try newer version: http://bugs.php.net/fix.php?id=30892&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=30892&r=support Expected behavior: http://bugs.php.net/fix.php?id=30892&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=30892&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=30892&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=30892&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=30892&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=30892&r=dst IIS Stability: http://bugs.php.net/fix.php?id=30892&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=30892&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=30892&r=float MySQL Configuration Error: http://bugs.php.net/fix.php?id=30892&r=mysqlcfg