A flaw was found in BusyBox's httpd. handle_incoming_and_exit() allocates a stack copy of the request URL sized for the current index page name, then parses the httpd.conf file of each directory on the requested path, and finally copies the index page name into that buffer with strcpy(). Because parse_conf() honors an "I:" index-page rule in subdirectory httpd.conf files, an overly long index page name in such a file overflows the stack buffer with attacker-chosen bytes when the directory is requested. A user who can write a subdirectory httpd.conf can use this to crash httpd or potentially execute arbitrary code in the forked child process, which runs as root unless the -u option is used.