Bug 869906 (CVE-2013-7345) - VUL-0: CVE-2013-7345: file: extensive backtracking in awk rule regular expression
Summary: VUL-0: CVE-2013-7345: file: extensive backtracking in awk rule regular expres...
Status: VERIFIED FIXED
Alias: CVE-2013-7345
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 12.3
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/97265/
Whiteboard: CVSSv2:NVD:CVE-2012-1571:4.3:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-24 12:07 UTC by Marcus Meissner
Modified: 2019-05-01 17:18 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2014-03-24 12:07:43 UTC
via rh#1079846 bugzilla

A flaw was reported in the rules file uses to detect AWK scripts. A malicious input file could cause the file utility to use 100% CPU.

Upstream bug: http://bugs.gw.com/view.php?id=164
Upstream fix: https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c

Relevant regular expression check for AWK file type via the following commit:

https://github.com/file/file/commit/e6b4015#diff-632ed2944e6b92e4b16ae8447f4f6e66

It first appear in version 5.05.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1079846
Comment 1 Marcus Meissner 2014-03-24 12:08:14 UTC
if it appears it only in 5.05, only openSUSE and SLE12 need it.
Comment 2 Dr. Werner Fink 2014-03-24 12:29:48 UTC
file-5.17/magic/Magdir/commands

!:mime  text/x-awk
0       regex           =^\\s{0,100}BEGIN\\s{0,100}[{]  awk script text

... SLES12 is on secure side
Comment 3 Dr. Werner Fink 2014-03-24 12:31:31 UTC
The same for openSUSE Factory
Comment 4 Dr. Werner Fink 2014-03-24 12:45:02 UTC
openSUSE:13.1 is safe

update/openSUSE_13.1> grep -B1  BEGIN file-5.15/magic/Magdir/commands
!:mime  text/x-awk
0       regex           =^\\s{0,100}BEGIN\\s{0,100}[{]  awk script text
Comment 5 Dr. Werner Fink 2014-03-24 12:55:28 UTC
openSUSE:12.3 SR#227307
Comment 6 Bernhard Wiedemann 2014-03-24 13:00:28 UTC
This is an autogenerated message for OBS integration:
This bug (869906) was mentioned in
https://build.opensuse.org/request/show/227307 12.3 / file
Comment 7 Swamp Workflow Management 2014-03-24 23:00:22 UTC
bugbot adjusting priority
Comment 8 Bernhard Wiedemann 2014-03-27 13:00:33 UTC
This is an autogenerated message for OBS integration:
This bug (869906) was mentioned in
https://build.opensuse.org/request/show/227736 12.3 / file
Comment 9 Swamp Workflow Management 2014-04-04 09:04:35 UTC
openSUSE-SU-2014:0481-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 869906
CVE References: CVE-2013-7345
Sources used:
openSUSE 12.3 (src):    file-5.11-12.23.1, python-magic-5.11-12.23.1
Comment 10 Johannes Segitz 2014-06-23 10:22:21 UTC
all packages fixed