Bug 1098155 (CVE-2014-0238) - CVE-2014-0238 file: CDF property info parsing nelements infinite loop
Summary: CVE-2014-0238 file: CDF property info parsing nelements infinite loop
Status: CLOSED ERRATA
Alias: CVE-2014-0238
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20140529,repor...
Keywords: Security
: 1098175 (view as bug list)
Depends On: 1080180 1103568 1103569 1114520 1114521 1119563 1119564 1120503 1120504 1120981 1149768 1149774 1238984 1238985
Blocks: 1065838 1101912 1149858 1210268
TreeView+ depends on / blocked
 
Reported: 2014-05-15 12:14 UTC by Francisco Alonso
Modified: 2015-11-30 07:21 UTC (History)
14 users (show)

Fixed In Version: php 5.4.29, php 5.5.13
Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-27 11:55:27 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1012 normal SHIPPED_LIVE Moderate: php53 and php security update 2014-08-06 09:14:44 UTC
Red Hat Product Errata RHSA-2014:1013 normal SHIPPED_LIVE Moderate: php security update 2014-08-06 10:05:17 UTC
Red Hat Product Errata RHSA-2014:1606 normal SHIPPED_LIVE Moderate: file security and bug fix update 2014-10-14 01:39:32 UTC
Red Hat Product Errata RHSA-2014:1765 normal SHIPPED_LIVE Important: php54-php security update 2014-10-30 23:45:24 UTC
Red Hat Product Errata RHSA-2014:1766 normal SHIPPED_LIVE Important: php55-php security update 2014-10-30 23:45:12 UTC
Red Hat Product Errata RHSA-2015:2155 normal SHIPPED_LIVE Moderate: file security and bug fix update 2015-11-19 08:39:11 UTC
PHP Bug Tracker 67327 None None None Never

Description Francisco Alonso 2014-05-15 12:14:49 UTC
A flaw was found in the way file parsed property information from Composite Document Files (CDF) files.  A property entry with 0 elements triggers an infinite loop.

The problem is in cdf_read_property_info() function in src/cdf.c:
https://github.com/file/file/blob/FILE5_18/src/cdf.c#L742

A for loop with counter i is used to loop through properties.  Inside it, nelements value is read from the input file.  For string type properties, there is additional nested for loop with counter j, which also increments counter i of the outer for loop.
https://github.com/file/file/blob/FILE5_18/src/cdf.c#L890

In cdf.c:

801	for (i = 0; i < sh.sh_properties; i++) {
..
814		if (inp[i].pi_type & CDF_VECTOR) {
815			nelements = CDF_GETUINT32(q, 1);
..
873		case CDF_LENGTH32_STRING:
874		case CDF_LENGTH32_WSTRING:
..
890			for (j = 0; j < nelements; j++, i++) {
..
905			}
906			i--;

Comment 1 Francisco Alonso 2014-05-15 12:54:49 UTC
*** Bug 1098175 has been marked as a duplicate of this bug. ***

Comment 2 Francisco Alonso 2014-05-22 13:09:54 UTC
Acknowledgments:

This issue was discovered by Francisco Alonso of Red Hat Product Security.

Comment 3 Remi Collet 2014-05-22 14:24:20 UTC
PHP bug https://bugs.php.net/bug.php?id=67327

Comment 6 Murray McAllister 2014-06-02 05:12:02 UTC
Public now: http://www.php.net/ChangeLog-5.php#5.5.13

Comment 7 Murray McAllister 2014-06-02 05:14:43 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1103569]

Comment 8 Murray McAllister 2014-06-02 05:14:46 UTC
Created file tracking bugs for this issue:

Affects: fedora-all [bug 1103568]

Comment 9 Tomas Hoger 2014-06-02 07:09:40 UTC
Fixed in PHP 5.4.29 and 5.5.13.

Comment 10 Fedora Update System 2014-06-17 23:31:14 UTC
php-5.5.13-3.fc20, php-phpunit-PHPUnit-MockObject-1.2.3-4.fc20, php-doctrine-orm-2.4.2-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-06-17 23:36:07 UTC
php-5.5.13-3.fc19, php-phpunit-PHPUnit-MockObject-1.2.3-4.fc19, php-doctrine-orm-2.4.2-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 18 Huzaifa S. Sidhpurwala 2014-07-18 06:12:07 UTC
Statement:

This issue did not affect the php and the file packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of file as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 19 Martin Prpič 2014-07-28 11:12:08 UTC
IssueDescription:

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Comment 20 errata-xmlrpc 2014-08-06 05:15:24 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1012 https://rhn.redhat.com/errata/RHSA-2014-1012.html

Comment 21 errata-xmlrpc 2014-08-06 06:05:55 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1013 https://rhn.redhat.com/errata/RHSA-2014-1013.html

Comment 24 errata-xmlrpc 2014-10-14 08:29:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1606 https://rhn.redhat.com/errata/RHSA-2014-1606.html

Comment 25 errata-xmlrpc 2014-10-30 19:46:03 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html

Comment 26 errata-xmlrpc 2014-10-30 19:47:36 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html

Comment 36 errata-xmlrpc 2015-11-19 08:08:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2155 https://rhn.redhat.com/errata/RHSA-2015-2155.html


Note You need to log in before you can comment on or make changes to this bug.