Programming Languages

[deviant]

Originally Posted by moetheman

Attempting to secure a Windows system is similar to trying to bail out a boat with a sieve. For proof of that, Google is Your Friend.

This isn't entirely true. I work in security and a majority of web based vulnerabilities over the last couple of years have been found in linux based systems and not windows. There have been numerous vulnerabilities found in PHP itself over the last couple of years that lead to all kinds of privilege escalation issues (and some famous incidents). Microsoft has done a much better job with locking down it's more recent product lines (2003 on). It is also a lot easier to over look input sanitisation in PHP applications which lead to SQL Injection, Remote File Includes, Null byte attacks, and cross site scripting. Here's a list of vulerabilites found in PHP ITSELF during may of this year alone.

PHP 5 'php_sprintf_appendstring()' Remote Integer Overflow Vulnerability
2008-05-28
http://www.securityfocus.com/bid/28392

PHP Multiple Input Validation Vulnerabilities
2008-05-28
http://www.securityfocus.com/bid/19582

PHP 5.2.5 and Prior Versions Multiple Vulnerabilities
2008-05-28
http://www.securityfocus.com/bid/29009

PHP cURL 'safe mode' Security Bypass Vulnerability
2008-05-28
http://www.securityfocus.com/bid/27413

PCRE Character Class Buffer Overflow Vulnerability
2008-05-23
http://www.securityfocus.com/bid/27786

PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
2008-05-20
http://www.securityfocus.com/bid/26403

PHP .Htaccess Safe_Mode and Open_Basedir Restriction-Bypass Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24661

PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
2008-05-20
http://www.securityfocus.com/bid/25498

PHP Chunk_Split() Function Integer Overflow Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24261

PHP Glob() Function Arbitrary Code Execution Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24922

PHP EXT/Session HTTP Response Header Injection Vulnerability
2008-05-20
http://www.securityfocus.com/bid/24268

T1lib intT1_Env_GetCompletePath Buffer Overflow Vulnerability
2008-05-13
http://www.securityfocus.com/bid/25079

GD Graphics Library PNG File Processing Denial of Service Vulnerability
2008-05-13
http://www.securityfocus.com/bid/24089

PCRE Regular Expression Heap Overflow Vulnerability
2008-05-05
http://www.securityfocus.com/bid/14620

There hasn't been a vulnerability found in ASP.NET since 2007 and even then there were only two found that year both relatively minor issues.

Let me be clear, I'm actually a linux guy and I hate using windows as an operating system outside of certian tasks. Internet Explorer and other items not included, Windows severs have actually become a very easy platform to secure especially in relation to the IIS/.Net webapp world in comparison to the alternatives.

I could also go into linux kernel vulns vs windows OS vulns but which is much the same story.

I still use linux and PHP for webapps, but I have to stay on top of it like a hawk.