readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    (CVE-2014-2270)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the file packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in the File     Information (fileinfo) extension rules for detecting     AWK files. A remote attacker could use this flaw to     cause a PHP application using fileinfo to consume an     excessive amount of CPU.(CVE-2013-7345)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-3479)

  - An ouf-of-bounds read flaw was found in the way the     file utility processed certain Pascal strings. A remote     attacker could cause an application using the file     utility (for example, PHP using the fileinfo module) to     crash if it was used to identify the type of the     attacker-supplied file.(CVE-2014-9652)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-0207)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-3480)

  - It was found that the fix for CVE-2012-1571 was     incomplete the File Information (fileinfo) extension     did not correctly parse certain Composite Document     Format (CDF) files. A remote attacker could use this     flaw to crash a PHP application using fileinfo via a     specially crafted CDF file.(CVE-2014-3587)

  - A buffer overflow flaw was found in the way the File     Information (fileinfo) extension processed certain     Pascal strings. A remote attacker able to make a PHP     application using fileinfo convert a specially crafted     Pascal string provided by an image file could cause     that application to crash.(CVE-2014-3478)

  - Multiple flaws were found in the File Information     (fileinfo) extension regular expression rules for     detecting various files. A remote attacker could use     either of these flaws to cause a PHP application using     fileinfo to consume an excessive amount of     CPU.(CVE-2014-3538)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-3487)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension handled search rules.
    A remote attacker could use this flaw to cause a PHP     application using fileinfo to crash or consume an     excessive amount of CPU.(CVE-2014-2270)

  - A flaw was found in the way the File Information     (fileinfo) extension parsed Executable and Linkable     Format (ELF) files. A remote attacker could use this     flaw to cause a PHP application using fileinfo to     consume an excessive amount of system     resources.(CVE-2014-8117)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-0237)

  - A flaw was found in the way the File Information     (fileinfo) extension parsed Executable and Linkable     Format (ELF) files. A remote attacker could use this     flaw to cause a PHP application using fileinfo to crash     or disclose certain portions of server     memory.(CVE-2014-9653)

  - A denial of service flaw was found in the way the File     Information (fileinfo) extension parsed certain     Composite Document Format (CDF) files. A remote     attacker could use this flaw to crash a PHP application     using fileinfo via a specially crafted CDF     file.(CVE-2014-0238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3686-1 advisory.

    Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could     use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

    Alexander Cherepanov discovered that file incorrectly handled certain long strings. An attacker could use     this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9621)

    Alexander Cherepanov discovered that file incorrectly handled certain malformed ELF files. An attacker     could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 14.04 LTS. (CVE-2014-9653)

    It was discovered that file incorrectly handled certain magic files. An attacker could use this issue with     a specially crafted magic file to cause a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2015-8865)

    It was discovered that file incorrectly handled certain malformed ELF files. An attacker could use this     issue to cause a denial of service. (CVE-2018-10360)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Docker images provided with SUSE CaaS Platform 2.0 have been updated to include the following updates: binutils :

  - Update to version 2.29

  - 18750 bsc#1030296 CVE-2014-9939

  - 20891 bsc#1030585 CVE-2017-7225

  - 20892 bsc#1030588 CVE-2017-7224

  - 20898 bsc#1030589 CVE-2017-7223

  - 20905 bsc#1030584 CVE-2017-7226

  - 20908 bsc#1031644 CVE-2017-7299

  - 20909 bsc#1031656 CVE-2017-7300

  - 20921 bsc#1031595 CVE-2017-7302

  - 20922 bsc#1031593 CVE-2017-7303

  - 20924 bsc#1031638 CVE-2017-7301

  - 20931 bsc#1031590 CVE-2017-7304

  - 21135 bsc#1030298 CVE-2017-7209

  - 21137 bsc#1029909 CVE-2017-6965

  - 21139 bsc#1029908 CVE-2017-6966

  - 21156 bsc#1029907 CVE-2017-6969

  - 21157 bsc#1030297 CVE-2017-7210

  - 21409 bsc#1037052 CVE-2017-8392

  - 21412 bsc#1037057 CVE-2017-8393

  - 21414 bsc#1037061 CVE-2017-8394

  - 21432 bsc#1037066 CVE-2017-8396

  - 21440 bsc#1037273 CVE-2017-8421

  - 21580 bsc#1044891 CVE-2017-9746

  - 21581 bsc#1044897 CVE-2017-9747

  - 21582 bsc#1044901 CVE-2017-9748

  - 21587 bsc#1044909 CVE-2017-9750

  - 21594 bsc#1044925 CVE-2017-9755

  - 21595 bsc#1044927 CVE-2017-9756

  - 21787 bsc#1052518 CVE-2017-12448

  - 21813 bsc#1052503, CVE-2017-12456, bsc#1052507,     CVE-2017-12454, bsc#1052509, CVE-2017-12453,     bsc#1052511, CVE-2017-12452, bsc#1052514,     CVE-2017-12450, bsc#1052503, CVE-2017-12456,     bsc#1052507, CVE-2017-12454, bsc#1052509,     CVE-2017-12453, bsc#1052511, CVE-2017-12452,     bsc#1052514, CVE-2017-12450

  - 21933 bsc#1053347 CVE-2017-12799

  - 21990 bsc#1058480 CVE-2017-14333

  - 22018 bsc#1056312 CVE-2017-13757

  - 22047 bsc#1057144 CVE-2017-14129

  - 22058 bsc#1057149 CVE-2017-14130

  - 22059 bsc#1057139 CVE-2017-14128

  - 22113 bsc#1059050 CVE-2017-14529

  - 22148 bsc#1060599 CVE-2017-14745

  - 22163 bsc#1061241 CVE-2017-14974

  - 22170 bsc#1060621 CVE-2017-14729

  - Make compressed debug section handling explicit, disable     for old products and enable for gas on all architectures     otherwise. [bsc#1029995]

  - Remove empty rpath component removal optimization from     to workaround CMake rpath handling. [bsc#1025282]

  - Fix alignment frags for aarch64 (bsc#1003846) coreutils :

  - Fix df(1) to no longer interact with excluded file     system types, so for example specifying -x nfs no longer     hangs with problematic nfs mounts. (bsc#1026567)

  - Ensure df -l no longer interacts with dummy file system     types, so for example no longer hangs with problematic     NFS mounted via system.automount(5). (bsc#1043059)

  - Significantly speed up df(1) for huge mount lists.
    (bsc#965780) file :

  - update to version 5.22.

  - CVE-2014-9621: The ELF parser in file allowed remote     attackers to cause a denial of service via a long     string. (bsc#913650)

  - CVE-2014-9620: The ELF parser in file allowed remote     attackers to cause a denial of service via a large     number of notes. (bsc#913651)

  - CVE-2014-9653: readelf.c in file did not consider that     pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a     denial of service (uninitialized memory access) or     possibly have unspecified other impact via a crafted ELF     file. (bsc#917152)

  - CVE-2014-8116: The ELF parser (readelf.c) in file     allowed remote attackers to cause a denial of service     (CPU consumption or crash) via a large number of (1)     program or (2) section headers or (3) invalid     capabilities. (bsc#910253)

  - CVE-2014-8117: softmagic.c in file did not properly     limit recursion, which allowed remote attackers to cause     a denial of service (CPU consumption or crash) via     unspecified vectors. (bsc#910253)

  - Fixed a memory corruption during rpmbuild (bsc#1063269)

  - Backport of a fix for an increased printable string     length as found in file 5.30 (bsc#996511)

  - file command throws 'Composite Document File V2     Document, corrupt: Can't read SSAT' error against excel     97/2003 file format. (bsc#1009966) gcc7 :

  - Support for specific IBM Power9 processor instructions.

  - Support for specific IBM zSeries z14 processor     instructions.

  - New packages cross-npvtx-gcc7 and nvptx-tools added to     the Toolchain Module for specific NVIDIA Card offload     support. gzip :

  - fix mishandling of leading zeros in the end-of-block     code (bsc#1067891) libsolv :

  - Many fixes and improvements for cleandeps.

  - Always create dup rules for 'distupgrade' jobs.

  - Use recommends also for ordering packages.

  - Fix splitprovides handling with addalreadyrecommended     turned off. (bsc#1059065)

  - Expose solver_get_recommendations() in bindings.

  - Fix bug in solver_prune_to_highest_prio_per_name     resulting in bad output from     solver_get_recommendations().

  - Support 'without' and 'unless' dependencies.

  - Use same heuristic as upstream to determine source RPMs.

  - Fix memory leak in bindings.

  - Add pool_best_solvables() function.

  - Fix 64bit integer parsing from RPM headers.

  - Enable bzip2 and xz/lzma compression support.

  - Enable complex/rich dependencies on distributions with     RPM 4.13+. libtool :

  - Add missing dependencies and provides to baselibs.conf     to make sure libltdl libraries are properly installed.
    (bsc#1056381) libzypp :

  - Fix media handling in presence of a repo path prefix.
    (bsc#1062561)

  - Fix RepoProvideFile ignoring a repo path prefix.
    (bsc#1062561)

  - Remove unused legacy notify-message script.
    (bsc#1058783)

  - Support multiple product licenses in repomd.
    (fate#322276)

  - Propagate 'rpm --import' errors. (bsc#1057188)

  - Fix typos in zypp.conf. openssl :

  - CVE-2017-3735: openssl1,openssl: Malformed X.509     IPAdressFamily could cause OOB read (bsc#1056058)

  - CVE-2017-3736: openssl: bn_sqrx8x_internal carry bug on     x86_64 (bsc#1066242)

  - Out of bounds read+crash in DES_fcrypt (bsc#1065363)

  - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA     ciphers (bsc#1055825) perl: Security issues for perl :

  - CVE-2017-12837: Heap-based buffer overflow in the     S_regatom function in regcomp.c in Perl 5 before     5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote     attackers to cause a denial of service (out-of-bounds     write) via a regular expression with a escape and the     case-insensitive modifier. (bnc#1057724)

  - CVE-2017-12883: Buffer overflow in the S_grok_bslash_N     function in regcomp.c in Perl 5 before 5.24.3-RC1 and     5.26.x before 5.26.1-RC1 allows remote attackers to     disclose sensitive information or cause a denial of     service (application crash) via a crafted regular     expression with an invalid escape. (bnc#1057721)

  - CVE-2017-6512: Race condition in the rmtree and     remove_tree functions in the File-Path module before     2.13 for Perl allows attackers to set the mode on     arbitrary files via vectors involving     directory-permission loosening logic. (bnc#1047178) Bug     fixes for perl :

  - backport set_capture_string changes from upstream     (bsc#999735)

  - reformat baselibs.conf as source validator workaround     systemd :

  - unit: When JobTimeoutSec= is turned off, implicitly turn     off JobRunningTimeoutSec= too. (bsc#1048605,     bsc#1004995)

  - compat-rules: Generate compat by-id symlinks with 'nvme'     prefix missing and warn users that have broken symlinks.
    (bsc#1063249)

  - compat-rules: Allow to specify the generation number     through the kernel command line.

  - scsi_id: Fixup prefix for pre-SPC inquiry reply.
    (bsc#1039099)

  - tmpfiles: Remove old ICE and X11 sockets at boot.

  - tmpfiles: Silently ignore any path that passes through     autofs. (bsc#1045472)

  - pam_logind: Skip leading /dev/ from PAM_TTY field before     passing it on.

  - shared/machine-pool: Fix another mkfs.btrfs checking.
    (bsc#1053595)

  - shutdown: Fix incorrect fscanf() result check.

  - shutdown: Don't remount,ro network filesystems.
    (bsc#1035386)

  - shutdown: Don't be fooled when detaching DM devices with     BTRFS. (bsc#1055641)

  - bash-completion: Add support for --now. (bsc#1053137)

  - Add convert-lib-udev-path.sh script to convert /lib/udev     directory into a symlink pointing to /usr/lib/udev when     upgrading from SLE11. (bsc#1050152)

  - Add a rule to teach hotplug to offline containers     transparently. (bsc#1040800) timezone :

  - Northern Cyprus switches from +03 to +02/+03 on     2017-10-29

  - Fiji ends DST 2018-01-14, not 2018-01-21

  - Namibia switches from +01/+02 to +02 on 2018-04-01

  - Sudan switches from +03 to +02 on 2017-11-01

  - Tonga likely switches from +13/+14 to +13 on 2017-11-05

  - Turks and Caicos switches from -04 to -05/-04 on     2018-11-04

  - Corrections to past DST transitions

  - Move oversized Canada/East-Saskatchewan to 'backward'     file

  - zic(8) and the reference runtime now reject multiple     leap seconds within 28 days of each other, or leap     seconds before the Epoch. util-linux :

  - Allow unmounting of filesystems without calling stat()     on the mount point, when '-c' is used. (bsc#1040968)

  - Fix an infinite loop, a crash and report the correct     minimum and maximum frequencies in lscpu for some     processors. (bsc#1055446)

  - Fix a lscpu failure on Sydney Amazon EC2 region.
    (bsc#1066500)

  - If multiple subvolumes are mounted, report the default     subvolume. (bsc#1039276) velum :

  - Fix logout issue on DEX download page * page doesn't     exist (bsc#1066611)

  - Handle invalid sessions more user friendly

  - Fix undesired minimum nodes alert blink (bsc#1066371)     wicked :

  - A regression in wicked was causing the hostname not to     be set correctly via DHCP in some cases     (bsc#1057007,bsc#1050258)

  - Configure the interface MTU correctly even in cases     where the interface was up already (bsc#1059292)

  - Don't abort the process that adds configures routes if     one route fails (bsc#1036619)

  - Handle DHCP4 user-class ids properly (bsc#1045522)

  - ethtool: handle channels parameters (bsc#1043883) zypper :

  - Locale: Fix possible segmentation fault. (bsc#1064999)

  - Add summary hint if product is better updated by a     different command. This is mainly used by rolling     distributions like openSUSE Tumbleweed to remind their     users to use 'zypper dup' to update (not zypper up or     patch). (bsc#1061384)

  - Unify '(add|modify)(repo|service)' property related     arguments.

  - Fixed 'add' commands supporting to set only a subset of     properties.

  - Introduced '-f/-F' as preferred short option for
    --[no-]refresh in all four commands. (bsc#661410,     bsc#1053671)

  - Fix missing package names in installation report.
    (bsc#1058695)

  - Differ between unsupported and packages with unknown     support status. (bsc#1057634)

  - Return error code '107' if an RPM's %post configuration     script fails, but only if ZYPPER_ON_CODE12_RETURN_107=1     is set in the environment. (bsc#1047233)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GNU file utility was updated to version 5.22. Security issues fixed :

  - CVE-2014-9621: The ELF parser in file allowed remote     attackers to cause a denial of service via a long     string. (bsc#913650)

  - CVE-2014-9620: The ELF parser in file allowed remote     attackers to cause a denial of service via a large     number of notes. (bsc#913651)

  - CVE-2014-9653: readelf.c in file did not consider that     pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a     denial of service (uninitialized memory access) or     possibly have unspecified other impact via a crafted ELF     file. (bsc#917152)

  - CVE-2014-8116: The ELF parser (readelf.c) in file     allowed remote attackers to cause a denial of service     (CPU consumption or crash) via a large number of (1)     program or (2) section headers or (3) invalid     capabilities. (bsc#910253)

  - CVE-2014-8117: softmagic.c in file did not properly     limit recursion, which allowed remote attackers to cause     a denial of service (CPU consumption or crash) via     unspecified vectors. (bsc#910253) Version update to file     version 5.22

  - add indirect relative for TIFF/Exif

  - restructure elf note printing to avoid repeated messages

  - add note limit, suggested by Alexander Cherepanov

  - Bail out on partial pread()'s (Alexander Cherepanov)

  - Fix incorrect bounds check in file_printable (Alexander     Cherepanov)

  - PR/405: ignore SIGPIPE from uncompress programs

  - change printable -> file_printable and use it in more     places for safety

  - in ELF, instead of '(uses dynamic libraries)' when     PT_INTERP is present print the interpreter name. Version     update to file version 5.21

  - there was an incorrect free in magic_load_buffers()

  - there was an out of bounds read for some pascal strings

  - there was a memory leak in magic lists

  - don't interpret strings printed from files using the     current locale, convert them to ascii format first.

  - there was an out of bounds read in elf note reads Update     to file version 5.20

  - recognize encrypted CDF documents

  - add magic_load_buffers from Brooks Davis

  - add thumbs.db support

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The GNU file utility was updated to version 5.22.

Security issues fixed :

  - CVE-2014-9621: The ELF parser in file allowed remote     attackers to cause a denial of service via a long     string. (bsc#913650)

  - CVE-2014-9620: The ELF parser in file allowed remote     attackers to cause a denial of service via a large     number of notes. (bsc#913651)

  - CVE-2014-9653: readelf.c in file did not consider that     pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a     denial of service (uninitialized memory access) or     possibly have unspecified other impact via a crafted ELF     file. (bsc#917152)

  - CVE-2014-8116: The ELF parser (readelf.c) in file     allowed remote attackers to cause a denial of service     (CPU consumption or crash) via a large number of (1)     program or (2) section headers or (3) invalid     capabilities. (bsc#910253)

  - CVE-2014-8117: softmagic.c in file did not properly     limit recursion, which allowed remote attackers to cause     a denial of service (CPU consumption or crash) via     unspecified vectors. (bsc#910253)

Version update to file version 5.22

  - add indirect relative for TIFF/Exif

  - restructure elf note printing to avoid repeated messages

  - add note limit, suggested by Alexander Cherepanov

  - Bail out on partial pread()'s (Alexander Cherepanov)

  - Fix incorrect bounds check in file_printable (Alexander     Cherepanov)

  - PR/405: ignore SIGPIPE from uncompress programs

  - change printable -> file_printable and use it in more     places for safety

  - in ELF, instead of '(uses dynamic libraries)' when     PT_INTERP is present print the interpreter name.

Version update to file version 5.21

  - there was an incorrect free in magic_load_buffers()

  - there was an out of bounds read for some pascal strings

  - there was a memory leak in magic lists

  - don't interpret strings printed from files using the     current locale, convert them to ascii format first.

  - there was an out of bounds read in elf note reads

Update to file version 5.20

  - recognize encrypted CDF documents

  - add magic_load_buffers from Brooks Davis

  - add thumbs.db support

Additional non-security bug fixes :

  - Fixed a memory corruption during rpmbuild (bsc#1063269)

  - Backport of a fix for an increased printable string     length as found in file 5.30 (bsc#996511)

  - file command throws 'Composite Document File V2     Document, corrupt: Can't read SSAT' error against excel     97/2003 file format. (bsc#1009966)

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201701-42 (file: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in file. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted input file, possibly resulting in execution of       arbitrary code with the privileges of the process, a Denial of Service       condition or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - Multiple flaws were found in the file regular expression     rules for detecting various files. A remote attacker     could use these flaws to cause file to consume an     excessive amount of CPU. (CVE-2014-3538)

  - A denial of service flaw was found in the way file     parsed certain Composite Document Format (CDF) files. A     remote attacker could use this flaw to crash file via a     specially crafted CDF file. (CVE-2014-3587)

  - Multiple flaws were found in the way file parsed     Executable and Linkable Format (ELF) files. A remote     attacker could use these flaws to cause file to crash,     disclose portions of its memory, or consume an excessive     amount of system resources. (CVE-2014-3710,     CVE-2014-8116, CVE-2014-8117, CVE-2014-9620,     CVE-2014-9653)

An update for file is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Security Fix(es) :

* Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

* A denial of service flaw was found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash file via a specially crafted CDF file.
(CVE-2014-3587)

* Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9620, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch (Intra2net AG) for reporting CVE-2014-8116 and CVE-2014-8117. The CVE-2014-3538 issue was discovered by Jan Kaluza (Red Hat Web Stack Team) and the CVE-2014-3710 issue was discovered by Francisco Alonso (Red Hat Product Security).

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2014-3538 (unrestricted regular expression     matching)

  - fix #1284826 - try to read ELF header to detect     corrupted one

  - fix #1263987 - fix bugs found by coverity in the patch

  - fix CVE-2014-3587 (incomplete fix for CVE-2012-1571)

  - fix CVE-2014-3710 (out-of-bounds read in elf note     headers)

  - fix CVE-2014-8116 (multiple DoS issues (resource     consumption))

  - fix CVE-2014-8117 (denial of service issue (resource     consumption))

  - fix CVE-2014-9620 (limit the number of ELF notes     processed)

  - fix CVE-2014-9653 (malformed elf file causes access to     uninitialized memory)

  - fix #809898 - add support for detection of Python 2.7     byte-compiled files

  - fix #1263987 - fix coredump execfn detection on ppc64     and s390

  - fix #966953 - include msooxml file in magic.mgc     generation

  - fix #966953 - increate the strength of MSOOXML magic     patterns

  - fix #1169509 - add support for Java 1.7 and 1.8

  - fix #1243650 - comment out too-sensitive Pascal magic

  - fix #1080453 - remove .orig files from magic directory

  - fix #1161058 - add support for EPUB

  - fix #1162149 - remove parts of patches patching .orig     files

  - fix #1154802 - fix detection of zip files containing     file named mime

  - fix #1246073 - fix detection UTF8 and UTF16 encoded XML     files

  - fix #1263987 - add new execfn to coredump output to show     the real name of executable which generated the coredump

  - fix #809898 - add support for detection of Python     3.2-3.5 byte-compiled files

  - fix #966953 - backport support for MSOOXML

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0760 advisory.

    - fix CVE-2014-3538 (unrestricted regular expression matching)
    - fix CVE-2014-3587 (incomplete fix for CVE-2012-1571)
    - fix CVE-2014-3710 (out-of-bounds read in elf note headers)
    - fix CVE-2014-8116 (multiple DoS issues (resource consumption))
    - fix CVE-2014-8117 (denial of service issue (resource consumption))
    - fix CVE-2014-9620 (limit the number of ELF notes processed)
    - fix CVE-2014-9653 (malformed elf file causes access to uninitialized memory)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0760 advisory.

    The file command is used to identify a particular file according to the type of data the file contains. It     can identify many different file types, including Executable and Linkable Format (ELF) binary files,     system libraries, RPM packages, and different graphics formats.

    Security Fix(es):

    * Multiple flaws were found in the file regular expression rules for detecting various files. A remote     attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

    * A denial of service flaw was found in the way file parsed certain Composite Document Format (CDF) files.
    A remote attacker could use this flaw to crash file via a specially crafted CDF file. (CVE-2014-3587)

    * Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote     attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an     excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9620,     CVE-2014-9653)

    Red Hat would like to thank Thomas Jarosch (Intra2net AG) for reporting CVE-2014-8116 and CVE-2014-8117.
    The CVE-2014-3538 issue was discovered by Jan Kalua (Red Hat Web Stack Team) and the CVE-2014-3710 issue     was discovered by Francisco Alonso (Red Hat Product Security).

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes     and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.
(BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688).

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2015:2155 :

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.
(BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688).

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.5.0. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists within the 'mod_deflate' module when     handling highly compressed bodies. A remote attacker can     exploit this, via a specially crafted request, to     exhaust memory and CPU resources, resulting in a denial     of service condition. (CVE-2014-0118)

  - The 'mod_status' module contains a race condition that     can be triggered when handling the scoreboard. A remote     attacker can exploit this to cause a denial of service,     execute arbitrary code, or obtain sensitive credential     information. (CVE-2014-0226)

  - The 'mod_cgid' module lacks a time out mechanism. A     remote attacker can exploit this, via a specially     crafted request, to cause child processes to linger     indefinitely, filling up the scoreboard and resulting in     a denial of service vulnerability. (CVE-2014-0231)

  - A flaw exists in WinNT MPM versions 2.4.1 to 2.4.9 when     using the default AcceptFilter. An attacker can exploit     this, via specially crafted requests. to create a memory     leak, resulting in a denial of service condition.
    (CVE-2014-3523)

  - A NULL pointer dereference flaw exists when the SSLv3     option isn't enabled and an SSLv3 ClientHello is     received. This allows a remote attacker, using an     unexpected handshake, to crash the daemon, resulting in     a denial of service. (CVE-2014-3569)

  - The BIGNUM squaring (BN_sqr) implementation does not     properly calculate the square of a BIGNUM value. This     allows remote attackers to defeat cryptographic     protection mechanisms. (CVE-2014-3570)

  - A NULL pointer dereference flaw exists in the     dtls1_get_record() function when handling DTLS messages.
    A remote attacker, using a specially crafted DTLS     message, can cause a denial of service. (CVE-2014-3571)

  - A flaw exists with ECDH handshakes when using an ECDSA     certificate without a ServerKeyExchange message. This     allows a remote attacker to trigger a loss of forward     secrecy from the ciphersuite. (CVE-2014-3572)

  - A use-after-free error exists in the     'process_nested_data' function within     'ext/standard/var_unserializer.re' due to improper     handling of duplicate keys within the serialized     properties of an object. A remote attacker, using a     specially crafted call to the 'unserialize' method, can     exploit this flaw to execute arbitrary code on the     system. (CVE-2014-8142)

  - A flaw exists when accepting non-DER variations of     certificate signature algorithms and signature encodings     due to a lack of enforcement of matches between signed     and unsigned portions. A remote attacker, by including     crafted data within a certificate's unsigned portion,     can bypass fingerprint-based certificate-blacklist     protection mechanisms. (CVE-2014-8275)

  - An out-of-bounds read flaw in file 'cgi_main.c' exists     when nmap is used to process an invalid file that begins     with a hash character (#) but lacks a newline character.
    A remote attacker, using a specially crafted PHP file,     can exploit this vulnerability to disclose memory     contents, cause a denial of service, or possibly execute     code. (CVE-2014-9427)

  - An out-of-bounds read error exists in the Fine Free File     component that is bundled with PHP. A remote attacker     can exploit this to cause a denial of service condition     or the disclosure of sensitive information.
    (CVE-2014-9652)

  - A memory corruption issue exists in the Fine Free File     component that is bundled with PHP. A remote attacker     can exploit this to cause an unspecified impact.
    (CVE-2014-9653)

  - A heap buffer overflow condition exists in PHP in the     enchant_broker_request_dict() function due to improper     validation of user-supplied input. An attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2014-9705)

  - A security feature bypass vulnerability, known as FREAK     (Factoring attack on RSA-EXPORT Keys), exists due to the     support of weak EXPORT_RSA cipher suites with keys less     than or equal to 512 bits. A man-in-the-middle attacker     may be able to downgrade the SSL/TLS connection to use     EXPORT_RSA cipher suites which can be factored in a     short amount of time, allowing the attacker to intercept     and decrypt the traffic. (CVE-2015-0204)

  - A flaw exists when accepting DH certificates for client     authentication without the CertificateVerify message.
    This allows a remote attacker to authenticate to the     service without a private key. (CVE-2015-0205)

  - A memory leak occurs in dtls1_buffer_record()     when handling a saturation of DTLS records containing     the same number sequence but for the next epoch. This     allows a remote attacker to cause a denial of service.
    (CVE-2015-0206)

  - A flaw exists in the DTLSv1_listen() function due to     state being preserved in the SSL object from one     invocation to the next. A remote attacker can exploit     this, via crafted DTLS traffic, to cause a segmentation     fault, resulting in a denial of service.
    (CVE-2015-0207)

  - A flaw exists in the rsa_item_verify() function due to     improper implementation of ASN.1 signature verification.
    A remote attacker can exploit this, via an ASN.1     signature using the RSA PSS algorithm and invalid     parameters, to cause a NULL pointer dereference,     resulting in a denial of service. (CVE-2015-0208)

  - A use-after-free condition exists in the     d2i_ECPrivateKey() function due to improper processing     of malformed EC private key files during import. A     remote attacker can exploit this to dereference or free     already freed memory, resulting in a denial of service     or other unspecified impact. (CVE-2015-0209)

  - A use-after-free memory error exists in the     process_nested_data() function in 'var_unserializer.re'     due to improper handling of duplicate numerical keys     within the serialized properties of an object. A remote     attacker, using a crafted unserialize method call, can     exploit this vulnerability to execute arbitrary code.
    (CVE-2015-0231)

  - A flaw exists in the exif_process_unicode() function in     'exif.c' that allows freeing an uninitialized pointer. A     remote attacker, using specially crafted EXIF data in a     JPEG image, can exploit this to cause a denial of     service or to execute arbitrary code. (CVE-2015-0232)

  - A use-after-free flaw exists in the function     php_date_timezone_initialize_from_hash() within the     'ext/date/php_date.c' script. An attacker can exploit     this to access sensitive information or crash     applications linked to PHP. (CVE-2015-0273)

  - A flaw exists in the ssl3_client_hello() function due to     improper validation of a PRNG seed before proceeding     with a handshake, resulting in insufficient entropy and     predictable output. This allows a man-in-the-middle     attacker to defeat cryptographic protection mechanisms     via a brute-force attack, resulting in the disclosure of     sensitive information. (CVE-2015-0285)

  - An invalid read error exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A flaw exists in the ASN1_item_ex_d2i() function due to     a failure to reinitialize 'CHOICE' and 'ADB' data     structures when reusing a structure in ASN.1 parsing.
    This allows a remote attacker to cause an invalid write     operation and memory corruption, resulting in a denial     of service. (CVE-2015-0287)

  - A NULL pointer dereference flaw exists in the     X509_to_X509_REQ() function due to improper processing     of certificate keys. This allows a remote attacker, via     a crafted X.509 certificate, to cause a denial of     service. (CVE-2015-0288)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing outer     ContentInfo. This allows a remote attacker, using an     application that processes arbitrary PKCS#7 data and     providing malformed data with ASN.1 encoding, to cause     a denial of service. (CVE-2015-0289)

  - A flaw exists with the 'multiblock' feature in the     ssl3_write_bytes() function due to improper handling of     certain non-blocking I/O cases. This allows a remote     attacker to cause failed connections or a segmentation     fault, resulting in a denial of service. (CVE-2015-0290)

  - A NULL pointer dereference flaw exists when handling     clients attempting to renegotiate using an invalid     signature algorithm extension. A remote attacker can     exploit this to cause a denial of service.
    (CVE-2015-0291)

  - An integer underflow condition exists in the     EVP_DecodeUpdate() function due to improper validation     of base64 encoded input when decoding. This allows a     remote attacker, using maliciously crafted base64 data,     to cause a segmentation fault or memory corruption,     resulting in a denial of service or possibly the     execution of arbitrary code. (CVE-2015-0292)

  - A flaw exists in servers that both support SSLv2 and     enable export cipher suites due to improper     implementation of SSLv2. A remote attacker can exploit     this, via a crafted CLIENT-MASTER-KEY message, to cause     a denial of service. (CVE-2015-0293)

  - A flaw exists in the ssl3_get_client_key_exchange()     function when client authentication and an ephemeral     Diffie-Hellman ciphersuite are enabled. This allows a     remote attacker, via a ClientKeyExchange message with a     length of zero, to cause a denial of service.
    (CVE-2015-1787)

  - A cross-site request forgery (XSRF) vulnerability exists     due to the lack of a unique token when performing     sensitive actions via HTTP requests. (CVE-2015-2134)

  - A use-after-free error exists in the function     phar_rename_archive() in file 'phar_object.c'. A remote     attacker, by attempting to rename a phar archive to an     already existing file name, can exploit this to cause     a denial of service. (CVE-2015-2301)

  - A use-after-free error exists related to function     'unserialize', which can allow a remote attacker to     execute arbitrary code. Note that this issue is due to     an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

  - A filter bypass vulnerability exists due to a flaw in     the move_uploaded_file() function in which pathnames are     truncated when a NULL byte is encountered. This allows a     remote attacker, via a crafted second argument, to     bypass intended extension restrictions and create files     with unexpected names. (CVE-2015-2348)

  - A user-after-free error exists in the     process_nested_data() function. This allows a remote     attacker, via a crafted unserialize call, to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-2787)

This update fixes the following issue in the file package :

CVE-2014-9653

readelf.c does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes. (CVE-2014-9620)

The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities. (CVE-2014-8116)

It was reported that a malformed elf file can cause file urility to access invalid memory. (CVE-2014-9653)

The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string. (CVE-2014-9621)

softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors. (CVE-2014-8117)

Hanno Boeck discovered that file's ELF parser is suspectible to denial of service.

Update to File-5.22. Fixes various CVE bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198569	RHEL 5 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124927	EulerOS Virtualization 3.0.1.0 : file (EulerOS-SA-2019-1424)	Nessus	Huawei Local Security Checks	high
110552	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : file vulnerabilities (USN-3686-1)	Nessus	Ubuntu Local Security Checks	high
106092	SUSE SLES12 Security Update : CaaS Platform 2.0 images (SUSE-SU-2018:0053-1)	Nessus	SuSE Local Security Checks	critical
104777	SUSE SLED12 / SLES12 Security Update : file (SUSE-SU-2017:3048-1)	Nessus	SuSE Local Security Checks	high
104764	openSUSE Security Update : file (openSUSE-2017-1298)	Nessus	SuSE Local Security Checks	high
96576	GLSA-201701-42 : file: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
91537	Scientific Linux Security Update : file on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	high
91167	CentOS 6 : file (CESA-2016:0760)	Nessus	CentOS Local Security Checks	high
91155	OracleVM 3.3 / 3.4 : file (OVMSA-2016-0050)	Nessus	OracleVM Local Security Checks	high
91149	Oracle Linux 6 : file (ELSA-2016-0760)	Nessus	Oracle Linux Local Security Checks	medium
91074	RHEL 6 : file (RHSA-2016:0760)	Nessus	Red Hat Local Security Checks	medium
87555	Scientific Linux Security Update : file on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	high
87137	CentOS 7 : file (CESA-2015:2155)	Nessus	CentOS Local Security Checks	high
87027	Oracle Linux 7 : file (ELSA-2015-2155)	Nessus	Oracle Linux Local Security Checks	high
86973	RHEL 7 : file (RHSA-2015:2155)	Nessus	Red Hat Local Security Checks	high
84923	HP System Management Homepage 7.3.x / 7.4.x < 7.5.0 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	high
82862	Debian DLA-204-1 : file security update	Nessus	Debian Local Security Checks	high
82046	Amazon Linux AMI : file (ALAS-2015-497)	Nessus	Amazon Linux Local Security Checks	high
81927	Debian DSA-3196-1 : file - security update	Nessus	Debian Local Security Checks	high
81394	Fedora 21 : file-5.22-2.fc21 (2015-2020)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2014-9653

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

medium

medium

high

high

high

high

high

high

high

high

high