Executive Summary

Summary
Title file: Denial of Service
Informations
Name GLSA-201209-14 First vendor Publication 2012-09-26
Vendor Gentoo Last vendor Modification 2012-09-26
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability in file could result in Denial of Service.

Background

file is a utility that guesses a file format by scanning binary data for patterns.

Description

Multiple out-of-bounds read errors and invalid pointer dereference errors have been found in cdf.c.

Impact

A remote attacker could entice a user to open a specially crafted Composite Document File (CDF) using file, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All file users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/file-5.11"

References

[ 1 ] CVE-2012-1571 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1571

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201209-14.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201209-14.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15392
 
Oval ID: oval:org.mitre.oval:def:15392
Title: DSA-2422-1 file -- missing bounds checks
Description: The file type identification tool, file, and its associated library, libmagic, do not properly process malformed files in the Composite Document File format, leading to crashes. Note that after this update, file may return different detection results for CDF files. The new detections are believed to be more accurate.
Family: unix Class: patch
Reference(s): DSA-2422-1
CVE-2012-1571
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): file
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29238
 
Oval ID: oval:org.mitre.oval:def:29238
Title: DSA-2422-2 -- file -- missing bounds checks
Description: The file type identification tool, file, and its associated library, libmagic, do not properly process malformed files in the Composite Document File (CDF) format, leading to crashes.
Family: unix Class: patch
Reference(s): DSA-2422-2
CVE-2012-1571
 Version: 3
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): file
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 45
Application 1

OpenVAS Exploits

Date Description
2012-09-26 Name : Gentoo Security Advisory GLSA 201209-14 (file)
File : nvt/glsa_201209_14.nasl
2012-08-03 Name : Mandriva Update for file MDVSA-2012:035 (file)
File : nvt/gb_mandriva_MDVSA_2012_035.nasl
2012-05-31 Name : Debian Security Advisory DSA 2422-2 (file)
File : nvt/deb_2422_2.nasl
2012-03-12 Name : Debian Security Advisory DSA 2422-1 (file)
File : nvt/deb_2422_1.nasl

Nessus® Vulnerability Scanner

Date Description
2016-08-12 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_70140f20600711e6a6c314dae9d210b8.nasl - Type : ACT_GATHER_INFO
2016-05-16 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0050.nasl - Type : ACT_GATHER_INFO
2016-01-22 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16875.nasl - Type : ACT_GATHER_INFO
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-080.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-10-17 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-10-14 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-415.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-398.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1327.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-09-30 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1326.nasl - Type : ACT_GATHER_INFO
2014-09-12 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-172.nasl - Type : ACT_GATHER_INFO
2014-09-03 Name : The remote Fedora host is missing a security update.
File : fedora_2014-9684.nasl - Type : ACT_GATHER_INFO
2014-09-03 Name : The remote Fedora host is missing a security update.
File : fedora_2014-9679.nasl - Type : ACT_GATHER_INFO
2014-08-07 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1012.nasl - Type : ACT_GATHER_INFO
2014-08-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1012.nasl - Type : ACT_GATHER_INFO
2014-07-06 Name : The remote Fedora host is missing a security update.
File : fedora_2014-7992.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-221.nasl - Type : ACT_GATHER_INFO
2014-02-27 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2123-1.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-14.nasl - Type : ACT_GATHER_INFO
2012-03-26 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-035.nasl - Type : ACT_GATHER_INFO
2012-03-01 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2422.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:37:34
  • Multiple Updates