CVE-2014-3538: Medium severity christos zoulas file 1 vulnerability
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Other sources
It was discovered the original upstream fix for the CVE-2013-7345 issue (bug 1079846) did not sufficiently address the problem. A specially-crafted input file could still cause file to use an excessive amount of CPU time when trying to detect file type using awk regular expression rule.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3538?
CVE-2014-3538 is considered a medium severity vulnerability due to its potential to cause denial of service through excessive CPU consumption.
How do I fix CVE-2014-3538?
To fix CVE-2014-3538, upgrade to file version 5.19 or later.
What software is affected by CVE-2014-3538?
CVE-2014-3538 affects versions of the 'file' command prior to 5.19 and specific versions of PHP up to 5.5.16 and 5.4.32.
What is the impact of exploiting CVE-2014-3538?
Exploitation of CVE-2014-3538 can lead to denial of service by consuming substantial CPU resources.
Who is the author of the software affected by CVE-2014-3538?
CVE-2014-3538 pertains to the 'file' utility developed by Christos Zoulas.