file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.

A specifically crafted Composite Document File (CDF) file can trigger an out-of-bounds read or an invalid pointer dereference.
[CVE-2012-1571]

A flaw in regular expression in the awk script detector makes use of multiple wildcards with unlimited repetitions. [CVE-2013-7345]

A malicious input file could trigger infinite recursion in libmagic(3). [CVE-2014-1943]

A specifically crafted Portable Executable (PE) can trigger out-of-bounds read. [CVE-2014-2270] Impact : An attacker who can cause file(1) or any other applications using the libmagic(3) library to be run on a maliciously constructed input can the application to crash or consume excessive CPU resources, resulting in a denial-of-service.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2014-3538 (unrestricted regular expression     matching)

  - fix #1284826 - try to read ELF header to detect     corrupted one

  - fix #1263987 - fix bugs found by coverity in the patch

  - fix CVE-2014-3587 (incomplete fix for CVE-2012-1571)

  - fix CVE-2014-3710 (out-of-bounds read in elf note     headers)

  - fix CVE-2014-8116 (multiple DoS issues (resource     consumption))

  - fix CVE-2014-8117 (denial of service issue (resource     consumption))

  - fix CVE-2014-9620 (limit the number of ELF notes     processed)

  - fix CVE-2014-9653 (malformed elf file causes access to     uninitialized memory)

  - fix #809898 - add support for detection of Python 2.7     byte-compiled files

  - fix #1263987 - fix coredump execfn detection on ppc64     and s390

  - fix #966953 - include msooxml file in magic.mgc     generation

  - fix #966953 - increate the strength of MSOOXML magic     patterns

  - fix #1169509 - add support for Java 1.7 and 1.8

  - fix #1243650 - comment out too-sensitive Pascal magic

  - fix #1080453 - remove .orig files from magic directory

  - fix #1161058 - add support for EPUB

  - fix #1162149 - remove parts of patches patching .orig     files

  - fix #1154802 - fix detection of zip files containing     file named mime

  - fix #1246073 - fix detection UTF8 and UTF16 encoded XML     files

  - fix #1263987 - add new execfn to coredump output to show     the real name of executable which generated the coredump

  - fix #809898 - add support for detection of Python     3.2-3.5 byte-compiled files

  - fix #966953 - backport support for MSOOXML

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270)

This update also fixes the following bugs :

* Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513)

* Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected.
(BZ#849621)

* Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997)

* Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected.
(BZ#884396)

* Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941)

* On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279)

* The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files.
(BZ#1064463)

* Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771)

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270)

This update also fixes the following bugs :

  - Previously, the output of the 'file' command contained     redundant white spaces. With this update, the new     STRING_TRIM flag has been introduced to remove the     unnecessary white spaces.

  - Due to a bug, the 'file' command could incorrectly     identify an XML document as a LaTex document. The     underlying source code has been modified to fix this bug     and the command now works as expected.

  - Previously, the 'file' command could not recognize .JPG     files and incorrectly labeled them as 'Minix     filesystem'. This bug has been fixed and the command now     properly detects .JPG files.

  - Under certain circumstances, the 'file' command     incorrectly detected NETpbm files as 'x86 boot sector'.
    This update applies a patch to fix this bug and the     command now detects NETpbm files as expected.

  - Previously, the 'file' command incorrectly identified     ASCII text files as a .PIC image file. With this update,     a patch has been provided to address this bug and the     command now correctly recognizes ASCII text files.

  - On 32-bit PowerPC systems, the 'from' field was missing     from the output of the 'file' command. The underlying     source code has been modified to fix this bug and 'file'     output now contains the 'from' field as expected.

  - The 'file' command incorrectly detected text files as     'RRDTool DB version ool - Round Robin Database Tool'.
    This update applies a patch to fix this bug and the     command now correctly detects text files.

  - Previously, the 'file' command supported only version 1     and 2 of the QCOW format. As a consequence, file was     unable to detect a 'qcow2 compat=1.1' file created on     Scientific Linux 7. With this update, support for QCOW     version 3 has been added so that the command now detects     such files as expected.

From Red Hat Security Advisory 2014:1606 :

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270)

This update also fixes the following bugs :

* Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513)

* Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected.
(BZ#849621)

* Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997)

* Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected.
(BZ#884396)

* Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941)

* On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279)

* The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files.
(BZ#1064463)

* Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771)

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

It was found that the fix for CVE-2012-1571 was incomplete; the File Information (fileinfo) extension did not correctly parse certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-3587)

A NULL pointer dereference flaw was found in the gdImageCreateFromXpm() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application using gd via a specially crafted X PixMap (XPM) file. (CVE-2014-2497)

Multiple buffer over-read flaws were found in the php_parserr() function of PHP. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-3597)

Two use-after-free flaws were found in the way PHP handled certain Standard PHP Library (SPL) Iterators and ArrayIterators. A malicious script author could possibly use either of these flaws to disclose certain portions of server memory. (CVE-2014-4670, CVE-2014-4698)

The CVE-2014-3597 issue was discovered by David Kutlek of the Red Hat BaseOS QE.

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE:
this vulnerability exists because of an incomplete fix for CVE-2012-1571 .

21 Aug 2014, PHP 5.5.16

Core :

  - Fixed bug #67693 (incorrect push to the empty array)     (Tjerk)

    - Fixed bug #67717 (segfault in dns_get_record).
      (CVE-2014-3597) (Remi)

COM :

  - Fixed missing type checks in com_event_sink (Yussuf     Khalil, Stas).

Fileinfo :

  - Fixed bug #67705 (extensive backtracking in rule regular     expression). (CVE-2014-3538) (Remi)

    - Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587)       (Remi)

FPM :

  - Fixed bug #67635 (php links to systemd libraries without     using pkg-config). (pacho at gentoo.org, Remi)

GD :

  - Fixed bug #66901 (php-gd 'c_color' NULL pointer     dereference). (CVE-2014-2497) (Remi)

    - Fixed bug #67730 (Null byte injection possible with       imagexxx functions). (CVE-2014-5120) (Ryan Mauger)

Milter :

  - Fixed bug #67715 (php-milter does not build and crashes     randomly). (Mike) OpenSSL :

  - Fixed missing type checks in OpenSSL options (Yussuf     Khalil, Stas).

readline :

  - Fixed bug #55496 (Interactive mode doesn't force a     newline before the prompt). (Bob, Johannes)

    - Fixed bug #67496 (Save command history when exiting       interactive shell with control-c). (Dmitry Saprykin,       Johannes)

Sessions :

  - Fixed missing type checks in php_session_create_id     (Yussuf Khalil, Stas).

ODBC :

  - Fixed bug #60616 (odbc_fetch_into returns junk data at     end of multi-byte char fields). (Keyur)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2014-3587.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1012 advisory.

    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
    - core: fix heap-based buffer overflow in DNS TXT record parsing.
      CVE-2014-4049
    - core: unserialize() SPL ArrayObject / SPLObjectStorage type       confusion flaw. CVE-2014-3515
    - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
    - fileinfo: unrestricted recursion in handling of indirect type       rules. CVE-2014-1943
    - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
    - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security.

All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Security update to new File version 5.19 fixing 8 CVEs found in previous two months.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

specially crafted CDF files could crash the 'file' program

It was discovered that file incorrectly handled Composite Document files. An attacker could use this issue to cause file to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2012-1571)

Bernd Melchers discovered that file incorrectly handled indirect offset values. An attacker could use this issue to cause file to consume resources or crash, resulting in a denial of service.
(CVE-2014-1943).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201209-14 (file: Denial of Service)

    Multiple out-of-bounds read errors and invalid pointer dereference       errors have been found in cdf.c.
  Impact :

    A remote attacker could entice a user to open a specially crafted       Composite Document File (CDF) using file, possibly resulting in a Denial       of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple out-of heap-based buffer read flaws and invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash (CVE-2012-1571).

The updated packages for Mandriva Linux 2011 have been upgraded to the 5.11 version and the packages for Mandriva Linux 2010.2 has been patched to correct these issues.

The file type identification tool, file, and its associated library, libmagic, do not properly process malformed files in the Composite Document File (CDF) format, leading to crashes.

Note that after this update, file may return different detection results for CDF files (well-formed or not). The new detections are believed to be more accurate.

ID	Name	Product	Family	Severity
92905	FreeBSD : FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3) (70140f20-6007-11e6-a6c3-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
91155	OracleVM 3.3 / 3.4 : file (OVMSA-2016-0050)	Nessus	OracleVM Local Security Checks	high
88064	F5 Networks BIG-IP : file vulnerability (SOL16875)	Nessus	F5 Networks Local Security Checks	medium
79185	CentOS 6 : file (CESA-2014:1606)	Nessus	CentOS Local Security Checks	medium
78843	Scientific Linux Security Update : file on SL6.x i386/x86_64 (20141014)	Nessus	Scientific Linux Local Security Checks	medium
78527	Oracle Linux 6 : file (ELSA-2014-1606)	Nessus	Oracle Linux Local Security Checks	medium
78419	Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140930)	Nessus	Scientific Linux Local Security Checks	medium
78414	RHEL 6 : file (RHSA-2014:1606)	Nessus	Red Hat Local Security Checks	medium
78358	Amazon Linux AMI : php55 (ALAS-2014-415)	Nessus	Amazon Linux Local Security Checks	medium
77482	Fedora 20 : php-5.5.16-1.fc20 (2014-9684)	Nessus	Fedora Local Security Checks	medium
77481	Fedora 19 : php-5.5.16-1.fc19 (2014-9679)	Nessus	Fedora Local Security Checks	medium
77363	Fedora 20 : file-5.19-4.fc20 (2014-9712)	Nessus	Fedora Local Security Checks	medium
77047	Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140806)	Nessus	Scientific Linux Local Security Checks	high
77043	Oracle Linux 5 / 6 : php53 / and / php (ELSA-2014-1012)	Nessus	Oracle Linux Local Security Checks	medium
77032	CentOS 5 / 6 : php / php53 (CESA-2014:1012)	Nessus	CentOS Local Security Checks	high
77015	RHEL 5 / 6 : php53 and php (RHSA-2014:1012)	Nessus	Red Hat Local Security Checks	high
76377	Fedora 20 : file-5.19-1.fc20 (2014-7992)	Nessus	Fedora Local Security Checks	medium
74598	openSUSE Security Update : file (openSUSE-SU-2012:0488-1)	Nessus	SuSE Local Security Checks	medium
72720	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : file vulnerabilities (USN-2123-1)	Nessus	Ubuntu Local Security Checks	medium
62343	GLSA-201209-14 : file: Denial of Service	Nessus	Gentoo Local Security Checks	medium
58474	Mandriva Linux Security Advisory : file (MDVSA-2012:035)	Nessus	Mandriva Local Security Checks	medium
58173	Debian DSA-2422-2 : file - missing bounds checks	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1571

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

high

high

medium

medium

medium

medium

medium

medium