181946 – sys-apps/file DOS bug (4.20 and 4.21)

Bug 181946 - sys-apps/file DOS bug (4.20 and 4.21)

Summary: sys-apps/file DOS bug (4.20 and 4.21)

Status:	RESOLVED DUPLICATE of bug 174217

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	x86 Linux

Importance:	Low minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2007-06-13 20:24 UTC by Daniel Carroll
Modified:	2007-06-13 20:40 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Carroll 2007-06-13 20:24:45 UTC

The file(1) command takes an extremely long time to parse certain files.

This problem exists with both sys-apps/file-4.20
and sys-apps/file-4.21.

A problem file can be created with the following perl script:

    perl -e 'print "\n"x162174;' > problem_file

Why is this a DoS?  If Amavis uses this command, it effectively causes the
amavis process to hang until the file(1) command completes several minutes
later.  Several messages with attachments like this going through a system
that scans all messages with AMaViS will either stop or slow e-mail delivery
way down. 

I don't know if this should be considered a file(1) bug or a bug in the magic
file.

Comment 1 Jakub Moc (RETIRED) gentoo-dev

2007-06-13 20:40:58 UTC


*** This bug has been marked as a duplicate of bug 174217 ***