vulnphf

Vulnerability Description

Brief description: The PHF CGI script passes shell mateacharacters through and executes them.

Full description: The phf program, and possibly other programs, call the escape_shell_cmd() function. This subroutine is intended to strip dangerous characters out prior to passing these strings along to shell based library calls, such as popen() or system(). By failing to capture certain characters, however, it becomes possible to execute commands from these calls.

Components: Apache 1.0.3 and below (trusted), NSCA httpd 1.5a-export and below (trusted); in these distributions any CGI program built using the sample code that allows input from the remote user and pases that input to a shell

Systems:

Effect(s) of exploiting: A remote user can execute commands with the privileges of the web server.

Detecting the hole:

    1. Search for phf and other such CGI executables on the system and check the version.

Fixing the hole:

    1. Remove phf and other such CGI executablesand/or patch the relevant http daemons.
    2. In the NCSA web server, version 1.5.1 does not contain this vulnerability, and is available from NCSA .
    3. In the Apache server, go to the escape_shell_command() function in the file src/util.c (it is around line 430). In that function, change the line that reads 
      if(ind("&;`'\"|*?~<>^()[]{}$\\",cmd[x]) != -1){
      to 
      if(ind("&;`'\"|*?~<>^()[]{}$\\\n",cmd[x]) != -1){
      Also, change the same line in cgi-src/util.c in exactly the same way.

Other information:

Keywords

Cataloguing

PA Classification(s):

RISOS Classification(s):

DCS Classification(s):

CVE Number: CVE-1999-0067 -- CGI phf program allows remote command execution through shell metacharacters.

Exploit Information

Attack:

Related Information

Advisories: CIAC Advisories G-20 and G-17 ; CERT Advisory CA-96:06, Vulnerability in NCSA/Apache CGI example code ; ISS X-Force entry http-cgi-phf Security Focus database entry 629 ; the original IBM advisories are ERS-SVA-E01-1996:002.1 and ERS-SVA-E01-1996:002.2

Related Vulnerabilities:

Reportage

Reporting: Jennifer Myers in IBM ERS Advisory (ERS-SVA-E01-1996:002.1) (16 April 1996 )

Revision Number 1

  1. Homer Briggs (6/26/2000):
    Created entry