Resource exhaustion in file - CVE-2014-1943

Vulnerability identifier: #VU16078

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-1943

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion when insufficient validation of user-supplied input. A local attacker can trigger CPU consumption and cause the service to crash.

file
Gentoo Linux
Amazon Linux AMI
Ubuntu
Slackware Linux
file (Alpine package)
libmagic1 (Ubuntu package)
file (Ubuntu package)
php5 (Ubuntu package)
dev-lang/php

Install updates from vendor's website.

file - update to 5.17
file (Alpine package) - update to 5.17-r0
libmagic1 (Ubuntu package) - addressed in versions 5.03-5ubuntu1.1, 5.09-2ubuntu0.2, 5.11-2ubuntu0.1, 5.11-2ubuntu4.1
file (Ubuntu package) - addressed in versions 5.03-5ubuntu1.1, 5.09-2ubuntu0.2, 5.11-2ubuntu0.1, 5.11-2ubuntu4.1
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.23, 5.3.10-1ubuntu3.10
dev-lang/php - update to 5.5.16

• https://github.com/file/file/blob/FILE5_17/ChangeLog

• Ubuntu update for PHP
• Amazon Linux AMI update for php55
• Amazon Linux AMI update for php54
• Amazon Linux AMI update for file
• Gentoo update for file
• Slackware Linux update for php
• Resource exhaustion in file (Alpine package)
• Gentoo update for PHP
• Ubuntu update for file