PHP script extension Problem

Vulnerable : Under PHP 4.0.3pl1


httpd.conf 
=======================================================
AddType application/x-httpd-php .php
=======================================================

=======================================================
cat > "phpbug1.php" << __EOF__
<?   phpinfo(); ?>
__EOF__
=======================================================

Generally, Apache refers to httpd.conf and recognizes 
the extension of "phpbug1.php" as an extension of PHP 
script.

=======================================================
cat > "phpbug2.php " << __EOF__
<? phpinfo(); ?>
__EOF__
=======================================================

In case of "phpbug2.php " script, it is treated as text
strings since it is recognized as "phpbug2.php%20".


*** Problem
=======================================================
cat > "phpbug3.php." << __EOF__
<? phpinfo(); ?>
__EOF__
=======================================================
cat > "phpbug4.php......." << __EOF__
<? phpinfo(); ?>
__EOF__
=======================================================

"phpbug3.php." has to be treated as normal text strings
since it's got no extension.

However, PHP engine recognizes "phpbug3.php." as a PHP 
script and excutes it. PHP engine executes 
"phpbug4.php......." as a php script too.


=========================================================
By: Young Gon Kim <younggon@hotmail.com> 12/5/2000
http://www.khdp.org/
http://drill.hackerslab.org/~piranha/
=========================================================