| Summary: | file new DoS issues fixed upstream in 5.22 (CVE-2014-962[01]) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | lewyssmith, olchal, sysadmin-bugs |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/630069/ | ||
| Whiteboard: | has_procedure advisory MGA4-64-OK MGA4-32-OK | ||
| Source RPM: | file-5.16-1.9.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-01-17 01:25:41 CET
David Walser
2015-01-17 01:25:48 CET
Whiteboard:
(none) =>
MGA4TOO CVE-2014-9620 and CVE-2014-9621 have been assigned: http://openwall.com/lists/oss-security/2015/01/17/9 CVE-2014-9620 relates to the processing of ELF notes and CVE-2014-9621 (which only affects file >= 5.16) relates to the processing of long strings in ELF notes. I actually hadn't checked the patches into SVN yet, but now they're appropriately named with the CVE numbers. Patched packages uploaded for Mageia 4 and Cauldron. Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=13460#c4 Besides running the file command on ~/* (i.e., the files in your home directory), you should also run it on some ELF files, as that's what's impacted by this update. Perhaps "file /usr/bin/*" and there will also be a ton of output and it shouldn't crash or hang. I've verified already that it works fine in Cauldron. Advisory: ======================== Updated file packages fix security vulnerabilities: Alexander Cherepanov reported that using the file command on a specially-crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption while processing ELF section headers (CVE-2014-9620, CVE-2014-9621). As part of the fixes, several limits on aspects of the detection were added or tightened, sometimes resulting in messages like "recursion limit exceeded" or "too many program header sections". To mitigate such shortcomings, these limits are controllable by a new -P, --parameter option in the file program. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9620 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9621 http://openwall.com/lists/oss-security/2015/01/17/9 https://www.debian.org/security/2015/dsa-3121 ======================== Updated packages in core/updates_testing: ======================== file-5.16-1.10.mga4 libmagic1-5.16-1.10.mga4 libmagic-devel-5.16-1.10.mga4 libmagic-static-devel-5.16-1.10.mga4 python-magic-5.16-1.10.mga4 from file-5.16-1.10.mga4.src.rpm Version:
Cauldron =>
4 Testing on Mageia4x64 real hardware, following procedure mentioned in Comment 1 From current packages : -------------------- file-5.16-1.9.mga4 python-magic-5.16-1.9.mga4 libmagic1-5.16-1.9.mga4 $ file ~/* $ file /usr/bin/* $ file /usr/sbin/* + python test found in procedure. Nothing to report To updated testing packages : --------------------------- file-5.16-1.10.mga4 python-magic-5.16-1.10.mga4 libmagic1-5.16-1.10.mga4 All OK CC:
(none) =>
olchal Tested fine for me on Mageia 4 i586 using the procedures in Comment 1. Whiteboard:
has_procedure MGA4-64-OK =>
has_procedure MGA4-64-OK MGA4-32-OK Testing MGA4 x64 real hardware Olivier beat me to it! I did the same with the current packages: $ file ~/* $ file ~/.* $ file /usr/bin/* $ python test.py (Having created the script given in https://bugs.mageia.org/show_bug.cgi?id=13460#c4) All output sensible. Updated to file-5.16-1.10.mga4, libmagic1-5.16-1.10.mga4, python-magic-5.16-1.10.mga4 All 4 tests ran similarly. OK verified. CC:
(none) =>
lewyssmith Validating. Advisory uploaded. Please push to 4 updates Thanks Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0030.html Status:
NEW =>
RESOLVED
David Walser
2015-01-20 20:15:28 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/630069/ The following commit has been assigned CVE-2014-9653: https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f It was included in this update. (In reply to David Walser from comment #7) > The following commit has been assigned CVE-2014-9653: > https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f > > It was included in this update. Here was the CVE assignment: http://openwall.com/lists/oss-security/2015/02/05/13 (In reply to David Walser from comment #8) > (In reply to David Walser from comment #7) > > The following commit has been assigned CVE-2014-9653: > > https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f > > > > It was included in this update. > > Here was the CVE assignment: > http://openwall.com/lists/oss-security/2015/02/05/13 LWN reference: http://lwn.net/Vulnerabilities/633829/ |