Home page logo
/

bugtraq logo Bugtraq mailing list archives

buffer overflow in `phf'
From: proton <proton () ENERGYMECH NET>
Date: Thu, 9 Nov 2000 07:11:09 +0100

PROBLEM:

...

main(int argc, char *argv[]) {
    entry entries[64];

...

    for(x=0;cl[0] != '\0';x++) {
        m=x;
        getword(entries[x].val,cl,'&');
        plustospace(entries[x].val);
        unescape_url(entries[x].val);
        getword(entries[x].name,entries[x].val,'=');
    }

...

The `for' loop does not verify that x is less than 64.
The `entries' struct being a flat data type will cause
any data written into the 64th entry to overwrite the
return pointer, allowing malicious code to be executed.

I have a working exploit for Linux/ix86 that I /may/ post to
bugtraq when system administrators has had a chance to
fix their servers.

Yes, I know phf is an old script but it is still fairly common.

This bug is unrelated to the bad chars filter problem that
is the best known vulnerability of phf.

VULNERABLE VERSIONS:

All known versions of phf (patched and unpatched)
(excluding fakes, ofcourse)

TO FIX:

Locate and DELETE all versions of phf.
Do NOT rename the executable, crackers might discover the
new name and exploit it (this is not uncommon).

/proton


  By Date           By Thread  

Current thread:
  • buffer overflow in `phf' proton (Nov 10)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]