The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.27. It is, therefore, potentially affected by a denial of service vulnerability.

A flaw exists in the awk script detector within magic/Magdir/commands where multiple wildcards with unlimited repetitions are used. This could allow a context dependent attacker to cause a denial of service with a specially crafted ASCII file.

Note that this plugin has not attempted to exploit this issue, but instead relied only on PHP's self-reported version number.

03 Apr 2014, PHP 5.5.11

Core :

  - Allow zero length comparison in substr_compare() (Tjerk)

    - Fixed bug #60602 (proc_open() changes environment       array) (Tjerk)

SPL :

  - Added feature #65545 (SplFileObject::fread()) (Tjerk)

cURL :

  - Fixed bug #66109 (Can't reset CURLOPT_CUSTOMREQUEST to     default behaviour) (Tjerk)

    - Fix compilation on libcurl versions between 7.10.5 and       7.12.2, inclusive. (Adam)

FPM :

  - Added clear_env configuration directive to disable     clearenv() call. (Github PR# 598, Paul Annesley)

Fileinfo :

  - Fixed bug #66946 (fileinfo: extensive backtracking in     awk rule regular expression). (CVE-2013-7345) (Remi)

GD :

  - Fixed bug #66714 (imageconvolution breakage). (Brad     Daily)

    - Fixed bug #66869 (Invalid 2nd argument crashes       imageaffinematrixget) (Pierre)

    - Fixed bug #66887 (imagescale - poor quality of scaled       image). (Remi)

    - Fixed bug #66890 (imagescale segfault). (Remi)

    - Fixed bug #66893 (imagescale ignore method argument).
      (Remi)

Hash :

  - hash_pbkdf2() now works correctly if the $length     argument is not specified. (Nikita)

Intl :

  - Fixed bug #66873 (A reproductible crash in UConverter     when given invalid encoding) (Stas)

Mail :

  - Fixed bug #66535 (Don't add newline after     X-PHP-Originating-Script) (Tjerk)

MySQLi :

  - Fixed bug #66762 (Segfault in mysqli_stmt::bind_result()     when link closed) (Remi)

OPCache :

  - Added function opcache_is_script_cached(). (Danack)

    - Added information about interned strings usage.
      (Terry, Julien, Dmitry)

Openssl :

  - Fixed bug #66833 (Default disgest algo is still MD5,     switch to SHA1). (Remi)

GMP :

  - Fixed bug #66872 (invalid argument crashes gmp_testbit)     (Pierre)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

file was updated to fix extensive backtracking in awk rule regular expression which could lead to a CPU consumption denial of service.

Several vulnerabilities have been found in file, a file type classification tool.

Aaron Reffett reported a flaw in the way the file utility determined the type of Portable Executable (PE) format files, the executable format used on Windows. When processing a defective or intentionally prepared PE executable which contains invalid offset information, the file_strncmp routine will access memory that is out of bounds, causing file to crash. The Common Vulnerabilities and Exposures project ID CVE-2014-2270 has been assigned to identify this flaw.

Mike Frysinger reported that file's rule for detecting AWK scripts significantly slows down file. The regular expression to detect AWK files contained two star operators, which could be exploited to cause excessive backtracking in the regex engine.

fix #1079847 - fix for CVE-2013-7345 fix #1079847 - fix for CVE-2013-7345

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1013 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. PHP's fileinfo module provides functions used to identify a     particular file according to the type of data contained by the file.

    A denial of service flaw was found in the File Information (fileinfo)     extension rules for detecting AWK files. A remote attacker could use this     flaw to cause a PHP application using fileinfo to consume an excessive     amount of CPU. (CVE-2013-7345)

    Multiple denial of service flaws were found in the way the File Information     (fileinfo) extension parsed certain Composite Document Format (CDF) files.
    A remote attacker could use either of these flaws to crash a PHP     application using fileinfo via a specially crafted CDF file.
    (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480,     CVE-2014-3487)

    A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT     records. A malicious DNS server or a man-in-the-middle attacker could     possibly use this flaw to execute arbitrary code as the PHP interpreter if     a PHP application used the dns_get_record() function to perform a DNS     query. (CVE-2014-4049)

    A type confusion issue was found in PHP's phpinfo() function. A malicious     script author could possibly use this flaw to disclose certain portions of     server memory. (CVE-2014-4721)

    A type confusion issue was found in the SPL ArrayObject and     SPLObjectStorage classes' unserialize() method. A remote attacker able to     submit specially crafted input to a PHP application, which would then     unserialize this input using one of the aforementioned methods, could use     this flaw to execute arbitrary code with the privileges of the user running     that PHP application. (CVE-2014-3515)

    The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479,     CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso     of Red Hat Product Security.

    All php users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, the httpd daemon must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1013 advisory.

    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237
    - fileinfo: CDF property info parsing nelements infinite       loop. CVE-2014-0238
    - fileinfo: cdf_check_stream_offset insufficient boundary       check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check       CVE-2014-3480
    - fileinfo: cdf_read_short_sector insufficient boundary       check. CVE-2014-0207
    - fileinfo: cdf_read_property_info insufficient boundary       check. CVE-2014-3487
    - fileinfo: fix extensive backtracking CVE-2013-7345
    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - core: fix heap-based buffer overflow in DNS TXT record       parsing. CVE-2014-4049

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
78285	Amazon Linux AMI : php55 (ALAS-2014-342)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
73338	PHP 5.4.x < 5.4.27 awk Magic Parsing BEGIN DoS	Nessus	CGI abuses	2014/4/4	2025/5/26	medium
73542	Fedora 20 : php-5.5.11-1.fc20 (2014-4767)	Nessus	Fedora Local Security Checks	2014/4/16	2021/1/11	medium
75311	openSUSE Security Update : file (openSUSE-SU-2014:0481-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
72952	Debian DSA-2873-1 : file - several vulnerabilities	Nessus	Debian Local Security Checks	2014/3/12	2021/1/11	medium
78275	Amazon Linux AMI : php55 (ALAS-2014-332)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
73218	Fedora 20 : file-5.14-20.fc20 (2014-4340)	Nessus	Fedora Local Security Checks	2014/3/27	2021/1/11	medium
77016	RHEL 7 : php (RHSA-2014:1013)	Nessus	Red Hat Local Security Checks	2014/8/6	2025/3/20	high
77044	Oracle Linux 7 : php (ELSA-2014-1013)	Nessus	Oracle Linux Local Security Checks	2014/8/7	2024/10/23	critical

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

high

critical