Kauft das PHP-Sicherheitsbuch!


Dritte Auflage
Jetzt das eBook bestellen!
€ 36,00
Als eBook nur € 28,99!

Links

XING
(Profil nur für Xing-Mitglieder sichtbar)
VServer Hosting
@christopherkunz

Pages

Frontpage
About Christopher Kunz
Kontaktformular

Tag cloud

@christopherkunz

Monday, April 2. 2012

Upgrade woes III: Suhosin and PHP 5.4.0

PHP

To complete the trinity of infamy: There is no Suhosin for PHP 5.4.0 either.


The patch is no longer bundled with distribution PHP. I have fired a mail to i0n1c about this but he seems to be in transit currently. The extension (0.9.33) does not compile with PHP 5.4.0 because of the copious API changes. 


Update: There is now a new version of Suhosin that is compatible with PHP 5.4.0 and 5.4.1. You can download it from Stefan Esser’s Github account (.tar.gz .zip). It compiles and runs well with PHP 5.4.0-3 (Debian Wheezy).


PHP 5.4.0-3 (cli) (built: Mar 21 2012 20:33:26)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
    with Suhosin v0.9.34-dev, Copyright (c) 2007-2012, by SektionEins GmbH


Thanks to andro for pointing this out. There is an installation howto over on php-security.net.
Posted by Christopher Kunz in PHP at 15:20 | Comments (4) | Trackbacks (2)
Defined tags for this entry: , , ,
Related entries by tags:

Trackbacks
Trackback specific URI for this entry

Upgrade woes II: eAccelerator and PHP 5.4.0
The “eAccelerator” project seems to be in hiatus. There haven’t been any changes to the downloadable files since 2010 (version 0.9.6.1). With PHP 5.4.0 released and a major bump in the Zend API coming with it, I was not expecting eAccele
Weblog: Dr. Christopher Kunz
Tracked: Apr 02, 15:29
Suhosin 0.9.34-dev installation howto
With the recently released PHP 5.4, the Suhosin patch and extension were removed from many Linux distribution packages (i.e., Debian et al.) and until three weeks ago, there was no possibility to compile and run the Suhosin extension under PHP 5.4. This l
Weblog: Yet Another PHP Security Blog
Tracked: May 03, 11:42

Comments
Display comments as (Linear | Threaded)

Is the http://www.hardened-php.net/Suhosin project still active? It doesn’t look like it is being maintained since 2007.

Thanks,
Chris Gillham, CISSP
#1 Chris Gillham (Homepage) on 2012-04-03 16:37 (Reply)
Suhosin was actively maintained well into 5.3 and the last commit on Github was three months ago. Seeing that Stefan Esser is currently very busy with other projects (including an upcoming book about iOS security), I’d suspect he doesn’t have lots of free time at hand to update Suhosin to 5.4.
#1.1 Chris (Homepage) on 2012-04-03 17:46 (Reply)
Hi,

use dev version of Suhosin v0.9.34-dev
https://github.com/stefanesser/suhosin

compile and work well on PHP 5.4.1 tested OK.
#2 andro on 2012-05-03 02:39 (Reply)
and APC is not support PHP5.4. :-(
#3 MagentoEye (Homepage) on 2012-07-09 08:35 (Reply)

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA