161 lines
6.2 KiB
Text
161 lines
6.2 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-14:16.file Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Multiple vulnerabilities in file(1) and libmagic(3)
|
|
|
|
Category: contrib
|
|
Module: file
|
|
Announced: 2014-06-24
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2014-06-24 19:04:55 UTC (stable/10, 10.0-STABLE)
|
|
2014-06-24 19:05:08 UTC (releng/10.0, 10.0-RELEASE-p6)
|
|
2014-06-24 19:04:55 UTC (stable/9, 9.3-PRERELEASE)
|
|
2014-06-24 19:05:19 UTC (releng/9.3, 9.3-RC2)
|
|
2014-06-24 19:05:36 UTC (releng/9.2, 9.2-RELEASE-p9)
|
|
2014-06-24 19:05:36 UTC (releng/9.1, 9.1-RELEASE-p16)
|
|
2014-06-24 19:04:55 UTC (stable/8, 8.4-STABLE)
|
|
2014-06-24 19:05:47 UTC (releng/8.4, 8.4-RELEASE-p13)
|
|
CVE Name: CVE-2012-1571, CVE-2013-7345, CVE-2014-1943, CVE-2014-2270
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:http://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The file(1) utility attempts to classify file system objects based on
|
|
filesystem, magic number and language tests.
|
|
|
|
The libmagic(3) library provides most of the functionality of file(1)
|
|
and may be used by other applications.
|
|
|
|
II. Problem Description
|
|
|
|
A specifically crafted Composite Document File (CDF) file can trigger an
|
|
out-of-bounds read or an invalid pointer dereference. [CVE-2012-1571]
|
|
|
|
A flaw in regular expression in the awk script detector makes use of
|
|
multiple wildcards with unlimited repetitions. [CVE-2013-7345]
|
|
|
|
A malicious input file could trigger infinite recursion in libmagic(3).
|
|
[CVE-2014-1943]
|
|
|
|
A specifically crafted Portable Executable (PE) can trigger out-of-bounds
|
|
read. [CVE-2014-2270]
|
|
|
|
III. Impact
|
|
|
|
An attacker who can cause file(1) or any other applications using the
|
|
libmagic(3) library to be run on a maliciously constructed input can
|
|
the application to crash or consume excessive CPU resources, resulting
|
|
in a denial-of-service.
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems where file(1) and other
|
|
libmagic(3)-using applications are never run on untrusted input are not
|
|
vulnerable.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
2) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
[FreeBSD 9.1, 9.2, 9.3, 10.0]
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:16/file.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:16/file.patch.asc
|
|
# gpg --verify file.patch.asc
|
|
|
|
[FreeBSD 8.4]
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:16/file-8.4.patch
|
|
# fetch http://security.FreeBSD.org/patches/SA-14:16/file-8.4.patch.asc
|
|
# gpg --verify file.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:http://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart all deamons using the library, or reboot the system.
|
|
|
|
3) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/8/ r267828
|
|
releng/8.4/ r267832
|
|
stable/9/ r267828
|
|
releng/9.1/ r267831
|
|
releng/9.2/ r267831
|
|
releng/9.3/ r267830
|
|
stable/10/ r267828
|
|
releng/10.0/ r267829
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:http://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571>
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345>
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943>
|
|
|
|
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:http://security.FreeBSD.org/advisories/FreeBSD-SA-14:16.file.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2
|
|
|
|
iQIcBAEBCgAGBQJTqc+KAAoJEO1n7NZdz2rnaLsP/jwrr5b1qZ9tObnN3FXwzEjD
|
|
jNHa3AJKHXgrYGzF8yNrZElhE48f02sr9dEXqIw/E5eElcVhi38RBEkwblE8Nj2H
|
|
M5bzEwVS7kWPcAl1vBno1rFTHutUTOSSopBGgwlNAlWSFnr1iFIIU9dQ6kcGCnBj
|
|
LvMx5kTSyZ707kArRrFjrDeYlPLSE/vSBOC00TqReS+3Q9By1IH5kUWesDWr+3Gk
|
|
lvW/JzSTcyOicrGR6vRHiLn9+NKojd6pV3hqV/uxuth1OxRtiGPeodL6CyvkipMo
|
|
rKjTgXEY2KluBGV9ff+rbeARLfUh2PDJ9Z5BfF7O8ZyMZpKkcw6MFRRfJ0xgtUZK
|
|
vpF0u8NVMIZhHLSJ9q1Roij2POxeOETNXG2bGKtVu8pqhJ14DvMfPgamsQLhzKRX
|
|
vBN1Gw+3RctJrQpF9HvYFOsKlfzcWyka82lw5GSsDYGH2TamU00CTQmx/5PW+WVo
|
|
xV3C17Wj8AkmRYWeC4IzkTiZ8avVOZ+TMyJKRhL6EGBT3ramu8BFdV8oZOcHHpR/
|
|
rAI6eZcFtNuwKuvfqHZmh84GicHDkMHXy6OiyCYUW9uNdWl7nUPMMxp/zEA6gtay
|
|
ozVedGIIrhYkfQAJRcRAcnEBYqcBVkCD/rKXJtdALl3RDQrediRaz0nWE2bJ/qs3
|
|
bHjS6vu9VS/3z0+pEYri
|
|
=5Ihe
|
|
-----END PGP SIGNATURE-----
|