Re: Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables

[Salvatore Bonaccorso <carnil () debian org>]

Hi,

On Wed, Mar 05, 2014 at 12:07:25PM -0500, cve-assign () mitre org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > file can be made to crash when checking some corrupt PE executables,
> > and so could be used to mount a denial of service for file, or an
> > application using file/libmagic.
>
> > http://bugs.gw.com/view.php?id=313
>
> > https://github.com/glensc/file/commit/447558595a3650db2886cd2f416ad0beba965801
>
> Use CVE-2014-2270.
>
> A CVE ID seems worthwhile because of possible libmagic use cases.
>
> "file can be made to crash" is typically not security-relevant on its
> own (a user can recover from this by not continuing to run file on the
> same crafted file). We're not sure whether any distribution has
> packages that rely on server-side use of libmagic, or whether it's
> common to have long-running processes that use libmagic with untrusted
> input.
[...]

Thanks for the CVE assignment and also for the clarification about
when a CVE might be assigned. I do not have a concrete example of such
an application, although php5 for example is embedding a copy of
libmagic/file which is used.

One question about the CVE ID, as the bug was submitted on 2013-12-20
should that have recieved a 2013 CVE?

Regards,
Salvatore