oss-sec mailing list archives
Re: Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables
From: Salvatore Bonaccorso <carnil () debian org>
Date: Wed, 5 Mar 2014 22:22:17 +0100
Hi, On Wed, Mar 05, 2014 at 12:07:25PM -0500, cve-assign () mitre org wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1file can be made to crash when checking some corrupt PE executables, and so could be used to mount a denial of service for file, or an application using file/libmagic.http://bugs.gw.com/view.php?id=313https://github.com/glensc/file/commit/447558595a3650db2886cd2f416ad0beba965801Use CVE-2014-2270. A CVE ID seems worthwhile because of possible libmagic use cases. "file can be made to crash" is typically not security-relevant on its own (a user can recover from this by not continuing to run file on the same crafted file). We're not sure whether any distribution has packages that rely on server-side use of libmagic, or whether it's common to have long-running processes that use libmagic with untrusted input.
[...] Thanks for the CVE assignment and also for the clarification about when a CVE might be assigned. I do not have a concrete example of such an application, although php5 for example is embedding a copy of libmagic/file which is used. One question about the CVE ID, as the bug was submitted on 2013-12-20 should that have recieved a 2013 CVE? Regards, Salvatore
Current thread:
- CVE Request: file: crashes when checking softmagic for some corrupt PE executables Salvatore Bonaccorso (Mar 03)
- Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables cve-assign (Mar 05)
- Re: Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables Salvatore Bonaccorso (Mar 05)
- Re: Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables Stuart Henderson (Mar 13)
- <Possible follow-ups>
- Re: Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables mancha (Mar 05)
- Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables cve-assign (Mar 05)