buffer overflow in `phf'

[proton <proton () ENERGYMECH NET>]

PROBLEM:

...

main(int argc, char *argv[]) {
    entry entries[64];

...

    for(x=0;cl[0] != '\0';x++) {
        m=x;
        getword(entries[x].val,cl,'&');
        plustospace(entries[x].val);
        unescape_url(entries[x].val);
        getword(entries[x].name,entries[x].val,'=');
    }

...

The `for' loop does not verify that x is less than 64.
The `entries' struct being a flat data type will cause
any data written into the 64th entry to overwrite the
return pointer, allowing malicious code to be executed.

I have a working exploit for Linux/ix86 that I /may/ post to
bugtraq when system administrators has had a chance to
fix their servers.

Yes, I know phf is an old script but it is still fairly common.

This bug is unrelated to the bad chars filter problem that
is the best known vulnerability of phf.

VULNERABLE VERSIONS:

All known versions of phf (patched and unpatched)
(excluding fakes, ofcourse)

TO FIX:

Locate and DELETE all versions of phf.
Do NOT rename the executable, crackers might discover the
new name and exploit it (this is not uncommon).

/proton