First published: Mon Mar 24 2014(Updated: )
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Christos Zoulas File 1 | <5.15 | |
PHP | >=5.4.0<5.4.27 | |
PHP | >=5.5.0<5.5.11 | |
Debian Linux | =6.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-7345 is classified as a denial of service vulnerability due to excessive CPU consumption.
To mitigate CVE-2013-7345, update the affected file utility to version 5.15 or later.
CVE-2013-7345 affects the 'file' utility versions prior to 5.15 and specific versions of PHP on various Debian Linux distributions.
CVE-2013-7345 allows attackers to cause a denial of service by using crafted ASCII files that exploit the vulnerable regular expression.
CVE-2013-7345 was reported in 2013 and affects several versions of file and PHP utilities.