[ GLSA 201408-08 ] file: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: file: Denial of Service (GLSA 201408-08)
Severity: normal
Exploitable: local, remote
Date: August 26, 2014
Updated: August 29, 2014
Bug(s): #505534
ID: 201408-08

Synopsis

A vulnerability in file could result in Denial of Service.

Background

file is a utility that guesses a file format by scanning binary data for
patterns.


Affected Packages

Package: sys-apps/file
Vulnerable: < 5.15
Unaffected: >= 5.15
Architectures: All supported architectures


Description

BEGIN regular expression in the awk script detector in
magic/Magdir/commands uses multiple wildcards with unlimited repetitions.


Impact

A context-dependent attacker could entice a user to open a specially
crafted file,
possibly resulting in a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All file users should upgrade to the latest version: