CVE-2013-7345
Published: 24 March 2014
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Notes
| Author | Note |
|---|---|
| jdstrand |
see regression fix in DSA-2873-2 |
| mdeslaur |
introduced in 5.05, but included in Debian specific patch in older releases. The fix for this issue was not complete, resulting in CVE-2014-3538. The proper fix in CVE-2014-3538 is intrusive. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
file
Launchpad, Ubuntu, Debian |
lucid |
Released
(5.03-5ubuntu1.3)
|
| precise |
Released
(5.09-2ubuntu0.4)
|
|
| quantal |
Ignored
(end of life)
|
|
| saucy |
Released
(5.11-2ubuntu4.3)
|
|
| trusty |
Released
(1:5.14-2ubuntu3.1)
|
|
| upstream |
Needs triage
|
|
|
Patches:
vendor: http://www.debian.org/security/2014/dsa-2873 upstream: https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c |
||