CVE-2013-7345
published 2014-03-24CVE-2013-7345: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.04%
86.0th percentile
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| christos_zoulas | file | < 5.15 | 5.15 |
| christos_zoulas | file | <= 5.18 | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| christos_zoulas | file | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | file | < file 1:5.17-0.1 (bookworm) | file 1:5.17-0.1 (bookworm) |
| debian | file | < file 1:5.19-1 (bookworm) | file 1:5.19-1 (bookworm) |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
file vulnerabilities
vendor_ubuntu·2014-07-15·CVSS 5.0
CVE-2013-7345 [MEDIUM] file vulnerabilities
Title: file vulnerabilities
Summary: File could be made to crash or hang if it processed specially crafted data.
Mike Frysinger discovered that the file awk script detector used multiple
wildcard with unlimited repetitions. An attacker could use this issue to
cause file to consume resources, resulting in a denial of service.
(CVE-2013-7345)
Francisco Alonso discovered that file incorrectly handled certain CDF
documents. A attacker could use this issue to cause file to hang or crash,
resulting in a denial of service. (CVE-2014-0207, CVE-2014-3478,
CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)
Jan Kaluža discovered that file did not properly restrict the amount of
data read during regex searches. An attacker could use this issue to
cause file to consume resources, resulting in a denial of
Red Hat
file: unrestricted regular expression matching
vendor_redhat·2014-06-27·CVSS 5.0
CVE-2014-3538 [MEDIUM] file: unrestricted regular expression matching
file: unrestricted regular expression matching
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Multiple flaws were found in the File Information (fileinfo) extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU.
Package: cdrtools (Red Hat Enterprise Linux 5) - Not affected
Package: file (Red Hat Enterprise Linux 5) - Not affected
Package: php (Red Hat Enterprise Linux 5) -
BSD
FreeBSD-SA-14:16.file: Multiple vulnerabilities in file(1) and libmagic(3)
bsd_advisories·2014-06-24·CVSS 6.5
CVE-2012-1571 [MEDIUM] FreeBSD-SA-14:16.file: Multiple vulnerabilities in file(1) and libmagic(3)
FreeBSD-SA-14:16.file Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in file(1) and libmagic(3)
Category: contrib
Module: file
Announced: 2014-06-24
Affects: All supported versions of FreeBSD.
Corrected: 2014-06-24 19:04:55 UTC (stable/10, 10.0-STABLE)
2014-06-24 19:05:08 UTC (releng/10.0, 10.0-RELEASE-p6)
2014-06-24 19:04:55 UTC (stable/9, 9.3-PRERELEASE)
2014-06-24 19:05:19 UTC (releng/9.3, 9.3-RC2)
2014-06-24 19:05:36 UTC (releng/9.2, 9.2-RELEASE-p9)
2014-06-24 19:05:36 UTC (releng/9.1, 9.1-RELEASE-p16)
2014-06-24 19:04:55 UTC (stable/8, 8.4-STABLE)
2014-06-24 19:05:47 UTC (releng/8.4, 8.4-RELEASE-p13)
CVE Name: CVE-2012-1571, CVE-2013-7345, CVE-2014-1943, CVE-2014-2270
For general information regarding FreeBSD Security Advisories,
including descriptions of the
Debian
CVE-2014-3538: file - file before 5.19 does not properly restrict the amount of data read during a reg...
vendor_debian·2014·CVSS 5.0
CVE-2014-3538 [MEDIUM] CVE-2014-3538: file - file before 5.19 does not properly restrict the amount of data read during a reg...
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Scope: local
bookworm: resolved (fixed in 1:5.19-1)
bullseye: resolved (fixed in 1:5.19-1)
forky: resolved (fixed in 1:5.19-1)
sid: resolved (fixed in 1:5.19-1)
trixie: resolved (fixed in 1:5.19-1)
Debian
CVE-2013-7345: file - The BEGIN regular expression in the awk script detector in magic/Magdir/commands...
vendor_debian·2013·CVSS 5.0
CVE-2013-7345 [MEDIUM] CVE-2013-7345: file - The BEGIN regular expression in the awk script detector in magic/Magdir/commands...
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Scope: local
bookworm: resolved (fixed in 1:5.17-0.1)
bullseye: resolved (fixed in 1:5.17-0.1)
forky: resolved (fixed in 1:5.17-0.1)
sid: resolved (fixed in 1:5.17-0.1)
trixie: resolved (fixed in 1:5.17-0.1)
Red Hat
file: extensive backtracking in awk rule regular expression
vendor_redhat·2011-12-31·CVSS 5.0
CVE-2013-7345 [MEDIUM] CWE-407 file: extensive backtracking in awk rule regular expression
file: extensive backtracking in awk rule regular expression
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU.
Statement: This issue did not affect the versions of file as shipped with Red Hat Enterprise Linux 5, 6, and 7, the versions of php as shi
VulDB
Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands access control (HT6443 / Nessus ID 73466)
vuldb·2026-05-08·CVSS 5.0
CVE-2013-7345 [MEDIUM] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands access control (HT6443 / Nessus ID 73466)
A vulnerability classified as problematic has been found in Apple Mac OS X up to 10.9.4. This affects an unknown part of the file magic/Magdir/commands of the component apache_mod_php. The manipulation leads to improper access controls.
This vulnerability is traded as CVE-2013-7345. It is possible to initiate the attack remotely. There is no exploit available.
It is recommended to upgrade the affected component.
VulDB
PHP up to 5.4.3 fileinfo magic/Magdir/commands access control (Commit ef2329c / ef2329c)
vuldb·2026-05-08·CVSS 5.0
CVE-2013-7345 [MEDIUM] PHP up to 5.4.3 fileinfo magic/Magdir/commands access control (Commit ef2329c / ef2329c)
A vulnerability classified as problematic was found in PHP up to 5.4.3. This issue affects some unknown processing of the file magic/Magdir/commands of the component fileinfo. Executing a manipulation can lead to improper access controls.
This vulnerability is handled as CVE-2013-7345. The attack can be executed remotely. There is not any exploit available.
It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-63f8-4qqh-pqqj: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5
ghsa_unreviewed·2022-05-17
CVE-2013-7345 [MEDIUM] GHSA-63f8-4qqh-pqqj: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
GHSA
GHSA-p2f8-8pr7-gprp: file before 5
ghsa_unreviewed·2022-05-14·CVSS 5.0
CVE-2014-3538 [MEDIUM] GHSA-p2f8-8pr7-gprp: file before 5
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
OSV
file vulnerabilities
osv·2014-07-15·CVSS 5.0
CVE-2013-7345 [MEDIUM] file vulnerabilities
file vulnerabilities
Mike Frysinger discovered that the file awk script detector used multiple
wildcard with unlimited repetitions. An attacker could use this issue to
cause file to consume resources, resulting in a denial of service.
(CVE-2013-7345)
Francisco Alonso discovered that file incorrectly handled certain CDF
documents. A attacker could use this issue to cause file to hang or crash,
resulting in a denial of service. (CVE-2014-0207, CVE-2014-3478,
CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)
Jan Kaluža discovered that file did not properly restrict the amount of
data read during regex searches. An attacker could use this issue to
cause file to consume resources, resulting in a denial of service.
(CVE-2014-3538)
OSV
CVE-2014-3538: file before 5
osv·2014-07-03·CVSS 5.0
CVE-2014-3538 [MEDIUM] CVE-2014-3538: file before 5
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
OSV
CVE-2013-7345: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5
osv·2014-03-24·CVSS 5.0
CVE-2013-7345 [MEDIUM] CVE-2013-7345: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0235 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
bugzilla·2014-06-30·CVSS 5.0
CVE-2014-0235 [MEDIUM] CVE-2014-0235 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
CVE-2014-0235 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when av
Bugzilla
CVE-2014-0235 php: file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
bugzilla·2014-06-30·CVSS 5.0
CVE-2014-0235 [MEDIUM] CVE-2014-0235 php: file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
CVE-2014-0235 php: file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field wh
Bugzilla
CVE-2014-3538 file: unrestricted regular expression matching
bugzilla·2014-05-15·CVSS 5.0
CVE-2014-3538 [MEDIUM] CVE-2014-3538 file: unrestricted regular expression matching
CVE-2014-3538 file: unrestricted regular expression matching
It was discovered the original upstream fix for the CVE-2013-7345 issue (bug 1079846) did not sufficiently address the problem. A specially-crafted input file could still cause file to use an excessive amount of CPU time when trying to detect file type using awk regular expression rule.
Discussion:
Patch proposed from Jan Kaluza:
0 search/16384 BEGIN
>0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
Not fixed upstream yet.
---
Acknowledgment:
Name: Jan Kaluža (Red Hat Web Stack Team)
---
(In reply to Francisco Alonso from comment #1)
> Patch proposed from Jan Kaluza:
>
>
> 0 search/16384 BEGIN
> >0 regex =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
This fix is also insufficient and easy to bypass. The first r
Bugzilla
CVE-2013-7345 file: extensive backtracking in awk rule regular expression
bugzilla·2014-03-24·CVSS 5.0
CVE-2013-7345 [MEDIUM] CVE-2013-7345 file: extensive backtracking in awk rule regular expression
CVE-2013-7345 file: extensive backtracking in awk rule regular expression
A flaw was reported in the rules file uses to detect AWK scripts. A malicious input file could cause the file utility to use 100% CPU.
Upstream bug: http://bugs.gw.com/view.php?id=164
Upstream fix: https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c
Discussion:
Created file tracking bugs for this issue:
Affects: fedora-all [bug 1079847]
---
Relevant regular expression check for AWK file type was introduced via the following commit:
https://github.com/file/file/commit/e6b4015#diff-632ed2944e6b92e4b16ae8447f4f6e66
It first appeared in version 5.05.
---
Created attachment 878158
Regression fix from Debian packages
Debian released updated advisory DSA 2873-2 that corrects regression i
Bugzilla
CVE-2013-7345 file: denial of service (CPU consumption) when processing certain files [fedora-all]
bugzilla·2014-03-24·CVSS 5.0
CVE-2013-7345 [MEDIUM] CVE-2013-7345 file: denial of service (CPU consumption) when processing certain files [fedora-all]
CVE-2013-7345 file: denial of service (CPU consumption) when processing certain files [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please
Bugzilla
CVE-2013-7345 php: file: extensive backtracking in awk rule regular expression [fedora-all]
bugzilla·2014-03-24·CVSS 5.0
CVE-2013-7345 [MEDIUM] CVE-2013-7345 php: file: extensive backtracking in awk rule regular expression [fedora-all]
CVE-2013-7345 php: file: extensive backtracking in awk rule regular expression [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note:
http://bugs.gw.com/view.php?id=164http://rhn.redhat.com/errata/RHSA-2014-1765.htmlhttp://support.apple.com/kb/HT6443http://www.debian.org/security/2014/dsa-2873https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703993https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467chttp://bugs.gw.com/view.php?id=164http://rhn.redhat.com/errata/RHSA-2014-1765.htmlhttp://support.apple.com/kb/HT6443http://www.debian.org/security/2014/dsa-2873https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703993https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c
2014-03-24
Published