CVE-2014-3538

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

http://mx.gw.com/pipermail/file/2014/001553.html

http://openwall.com/lists/oss-security/2014/06/30/7

http://rhn.redhat.com/errata/RHSA-2014-1327.html

http://rhn.redhat.com/errata/RHSA-2014-1765.html

http://rhn.redhat.com/errata/RHSA-2014-1766.html

http://rhn.redhat.com/errata/RHSA-2016-0760.html

http://secunia.com/advisories/60696

http://www.debian.org/security/2014/dsa-3008

http://www.debian.org/security/2014/dsa-3021

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.securityfocus.com/bid/68348

https://bugzilla.redhat.com/show_bug.cgi?id=1098222

https://github.com/file/file/commit/4a284c89d6ef11aca34da65da7d673050a5ea320

https://github.com/file/file/commit/69a5a43b3b71f53b0577f41264a073f495799610

https://github.com/file/file/commit/71a8b6c0d758acb0f73e2e51421a711b5e9d6668

https://github.com/file/file/commit/74cafd7de9ec99a14f4480927580e501c8f852c3

https://github.com/file/file/commit/758e066df72fb1ac08d2eea91ddc3973d259e991

https://support.apple.com/HT204659

Details

Source: MITRE

Published: 2014-07-03

Updated: 2018-01-05

Type: CWE-399

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Tenable Plugins

View all (32 total)

IDNameProductFamilySeverity
124927EulerOS Virtualization 3.0.1.0 : file (EulerOS-SA-2019-1424)NessusHuawei Local Security Checks
high
700510Mac OS X 10.10.x < 10.10.3 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
91537Scientific Linux Security Update : file on SL6.x i386/x86_64 (20160510)NessusScientific Linux Local Security Checks
high
91167CentOS 6 : file (CESA-2016:0760)NessusCentOS Local Security Checks
high
91155OracleVM 3.3 / 3.4 : file (OVMSA-2016-0050)NessusOracleVM Local Security Checks
high
91149Oracle Linux 6 : file (ELSA-2016-0760)NessusOracle Linux Local Security Checks
high
91074RHEL 6 : file (RHSA-2016:0760)NessusRed Hat Local Security Checks
high
87555Scientific Linux Security Update : file on SL7.x x86_64 (20151119)NessusScientific Linux Local Security Checks
high
87137CentOS 7 : file (CESA-2015:2155)NessusCentOS Local Security Checks
high
87027Oracle Linux 7 : file (ELSA-2015-2155)NessusOracle Linux Local Security Checks
high
86973RHEL 7 : file (RHSA-2015:2155)NessusRed Hat Local Security Checks
high
82700Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)NessusMacOS X Local Security Checks
critical
82699Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)NessusMacOS X Local Security Checks
critical
82333Mandriva Linux Security Advisory : php (MDVSA-2015:080)NessusMandriva Local Security Checks
high
82212Debian DLA-67-1 : php5 security updateNessusDebian Local Security Checks
medium
82197Debian DLA-50-1 : file security updateNessusDebian Local Security Checks
medium
78556PHP 5.6.0 Multiple VulnerabilitiesNessusCGI abuses
high
78325Amazon Linux AMI : file (ALAS-2014-382)NessusAmazon Linux Local Security Checks
medium
78009RHEL 7 : php (RHSA-2014:1327)NessusRed Hat Local Security Checks
medium
78005Oracle Linux 7 : php (ELSA-2014-1327)NessusOracle Linux Local Security Checks
medium
77996CentOS 7 : php (CESA-2014:1327)NessusCentOS Local Security Checks
medium
77651Mandriva Linux Security Advisory : php (MDVSA-2014:172)NessusMandriva Local Security Checks
medium
77585Debian DSA-3021-1 : file - security updateNessusDebian Local Security Checks
medium
77543Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-247-01)NessusSlackware Local Security Checks
medium
8360PHP 5.4.x < 5.4.32 / 5.5.x < 5.5.16 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
77403PHP 5.5.x < 5.5.16 Multiple VulnerabilitiesNessusCGI abuses
medium
77402PHP 5.4.x < 5.4.32 Multiple VulnerabilitiesNessusCGI abuses
medium
77307Debian DSA-3008-1 : php5 - security updateNessusDebian Local Security Checks
medium
77037Mandriva Linux Security Advisory : php (MDVSA-2014:149)NessusMandriva Local Security Checks
medium
76953Mandriva Linux Security Advisory : file (MDVSA-2014:146)NessusMandriva Local Security Checks
medium
76525Ubuntu 10.04 LTS / 12.04 LTS / 13.10 / 14.04 LTS : file vulnerabilities (USN-2278-1)NessusUbuntu Local Security Checks
medium
76377Fedora 20 : file-5.19-1.fc20 (2014-7992)NessusFedora Local Security Checks
medium