jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and     CPU and disk consumption) via a crafted JavaScript file. (CVE-2014-7204)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for ctags fixes the following issues :

  - CVE-2014-7204: Potential denial of service (infinite     loop and CPU and disk consumption) via a crafted     JavaScript file. (bsc#899486)

  - Missing Requires(post) on coreutils as it is using     rm(1). (bsc#976920)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated ctags package fixes security vulnerability :

A denial of service issue was discovered in ctags 5.8. A remote attacker could cause excessive CPU usage and disk space consumption via a crafted JavaScript file by triggering an infinite loop (CVE-2014-7204).

Stefano Zacchiroli discovered that certain JavaScript input files cause ctags to enter an infinite loop until it runs out of disk space.
This update fixes the JavaScript parser.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service issue was discovered in ctags. This could lead to excessive CPU and disk space consumption.

This update resolves this issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2371-1 advisory.

    It was discovered that Exuberant Ctags incorrectly handled certain minified js files. An attacker could     use this issue to possibly cause Exuberant Ctags to consume resources, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stefano Zacchiroli discovered a vulnerability in exuberant-ctags, a tool to build tag file indexes of source code definitions: Certain JavaScript files cause ctags to enter an infinite loop until it runs out of disk space, resulting in denial of service.

ID	Name	Product	Family	Severity
218624	Linux Distros Unpatched Vulnerability : CVE-2014-7204	Nessus	Misc.	high
93297	SUSE SLED12 / SLES12 Security Update : ctags (SUSE-SU-2016:2097-1)	Nessus	SuSE Local Security Checks	medium
82453	Mandriva Linux Security Advisory : ctags (MDVSA-2015:178)	Nessus	Mandriva Local Security Checks	medium
82214	Debian DLA-69-1 : exuberant-ctags security update	Nessus	Debian Local Security Checks	medium
78685	Mandriva Linux Security Advisory : ctags (MDVSA-2014:206)	Nessus	Mandriva Local Security Checks	medium
78248	Fedora 20 : ctags-5.8-16.fc20 (2014-11924)	Nessus	Fedora Local Security Checks	medium
78107	Ubuntu 14.04 LTS : Exuberant Ctags vulnerability (USN-2371-1)	Nessus	Ubuntu Local Security Checks	high
78044	Debian DSA-3042-1 : exuberant-ctags - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-7204

high

Tenable Plugins

high

medium

medium

medium

medium

medium

high

medium