Bug 1098222 (CVE-2014-3538) - CVE-2014-3538 file: unrestricted regular expression matching
Summary: CVE-2014-3538 file: unrestricted regular expression matching
Status: CLOSED ERRATA
Alias: CVE-2014-3538
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20140627,repor...
Keywords: Security
Depends On: 1114443 1114444 1140026 1140027 1149768 1149774 1238984 1238985 1284826 1416778
Blocks: 1065838 1101912 1138881 1149858 1210268
TreeView+ depends on / blocked
 
Reported: 2014-05-15 13:52 UTC by Francisco Alonso
Modified: 2019-06-08 20:03 UTC (History)
16 users (show)

(edit)
Multiple flaws were found in the File Information (fileinfo) extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU.
Clone Of:
(edit)
Last Closed: 2016-05-11 06:47:48 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1327 normal SHIPPED_LIVE Moderate: php security update 2014-09-30 13:09:42 UTC
PHP Bug Tracker 67705 None None None Never
Red Hat Product Errata RHSA-2014:1765 normal SHIPPED_LIVE Important: php54-php security update 2014-10-30 23:45:24 UTC
Red Hat Product Errata RHSA-2014:1766 normal SHIPPED_LIVE Important: php55-php security update 2014-10-30 23:45:12 UTC
Red Hat Product Errata RHSA-2015:2155 normal SHIPPED_LIVE Moderate: file security and bug fix update 2015-11-19 08:39:11 UTC
Red Hat Product Errata RHSA-2016:0760 normal SHIPPED_LIVE Moderate: file security, bug fix, and enhancement update 2016-05-10 22:32:51 UTC

Description Francisco Alonso 2014-05-15 13:52:56 UTC
It was discovered the original upstream fix for the CVE-2013-7345 issue (bug 1079846) did not sufficiently address the problem.  A specially-crafted input file could still cause file to use an excessive amount of CPU time when trying to detect file type using awk regular expression rule.

Comment 1 Francisco Alonso 2014-05-22 12:47:18 UTC
Patch proposed from Jan Kaluza:


0       search/16384    BEGIN
>0      regex           =^\\s{0,100}BEGIN\\s{0,100}[{]  awk script text


Not fixed upstream yet.

Comment 2 Francisco Alonso 2014-05-23 07:40:49 UTC
Acknowledgment:

Name: Jan Kaluža (Red Hat Web Stack Team)

Comment 5 Tomas Hoger 2014-05-28 07:31:17 UTC
(In reply to Francisco Alonso from comment #1)
> Patch proposed from Jan Kaluza:
> 
> 
> 0       search/16384    BEGIN
> >0      regex           =^\\s{0,100}BEGIN\\s{0,100}[{]  awk script text

This fix is also insufficient and easy to bypass.  The first rule can be satisfied by having BEGIN somewhere in the first 16384 bytes of the input, but in a way that it does not satisfy the regex of the subsequent rule, making the regex do the full exhaustive search.

Comment 7 Francisco Alonso 2014-05-29 08:32:01 UTC
Upstream commit:
https://github.com/file/file/commit/0b478f445b6b7540b58af5d1fe583fa9e48fd745

Comment 8 Salvatore Bonaccorso 2014-06-27 12:26:59 UTC
Hi Francisco

Is the assignment CVE-2014-0235 correct? On

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0235

apparently this is for Microsoft Internet Explorer 9.

Thanks for clarification, and Regards,
Salvatore

Comment 9 Francisco Alonso 2014-06-30 06:16:07 UTC
Hi Salvatore, 

We have assigned this CVE from our internal pool. Thanks for ask in OSS mailing list and we will wait the MITRE answer to assign a new CVE for this issue.

Best, Francisco Alonso.

Comment 10 Francisco Alonso 2014-06-30 06:17:34 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1114444]

Comment 11 Francisco Alonso 2014-06-30 06:17:37 UTC
Created file tracking bugs for this issue:

Affects: fedora-all [bug 1114443]

Comment 12 Tomas Hoger 2014-06-30 08:26:18 UTC
(In reply to Francisco Alonso from comment #7)
> Upstream commit:
> https://github.com/file/file/commit/0b478f445b6b7540b58af5d1fe583fa9e48fd745

As noted in comment 5, this fix is insufficient and the additional check can be easily bypassed.

Comment 13 Tomas Hoger 2014-06-30 11:11:35 UTC
This is the change that actually made it to file 5.19:

https://github.com/file/file/commit/71a8b6c0d758acb0f73e2e51421a711b5e9d6668

It relies on the following new feature that introduced regex/<length> syntax that makes it possible to limit the maximum length of the input matched by a regex defined in magic file:

https://github.com/file/file/commit/74cafd7de9ec99a14f4480927580e501c8f852c3
https://github.com/file/file/commit/69a5a43b3b71f53b0577f41264a073f495799610
https://github.com/file/file/commit/758e066df72fb1ac08d2eea91ddc3973d259e991

This additional commit introduced a limit of 8k applied to all regex rules by default (note that it's one of the multiple changes in the commit):

https://github.com/file/file/commit/4a284c89d6ef11aca34da65da7d673050a5ea320

Comment 14 Tomas Hoger 2014-07-03 08:19:50 UTC
The CVE-2014-0235 id previously used here was replaced by CVE-2014-3538, as CVE-2014-0235 was previously incorrectly used for a flaw in Microsoft Internet Explorer 9:

http://seclists.org/oss-sec/2014/q2/704
http://seclists.org/oss-sec/2014/q2/710
http://seclists.org/oss-sec/2014/q3/18

Comment 15 Fedora Update System 2014-07-05 14:53:34 UTC
file-5.19-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 21 Vincent Danen 2014-08-22 18:53:46 UTC
This is corrected in upstream PHP 5.5.16:

http://php.net/ChangeLog-5.php#5.5.16

Comment 25 Tomas Hoger 2014-09-11 08:42:35 UTC
As noted in comment 13, the fix that was applied corrected more than just the problematic awk rule by adding limit on the length of the input any regular expression can match.

Comment 26 Martin Prpič 2014-09-25 12:12:52 UTC
IssueDescription:

Multiple flaws were found in the File Information (fileinfo) extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU.

Comment 27 errata-xmlrpc 2014-09-30 09:09:59 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html

Comment 30 errata-xmlrpc 2014-10-30 19:46:08 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html

Comment 31 errata-xmlrpc 2014-10-30 19:47:41 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html

Comment 35 errata-xmlrpc 2015-11-19 08:08:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2155 https://rhn.redhat.com/errata/RHSA-2015-2155.html

Comment 36 errata-xmlrpc 2016-05-10 19:46:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0760 https://rhn.redhat.com/errata/RHSA-2016-0760.html


Note You need to log in before you can comment on or make changes to this bug.