Heap-Based Buffer Overflow in File Package: CVE-2019-18218
Summary
ALPINE-CVE-2019-18218: cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Affects file versions < 5.37-r1. Fixed in 5.37-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'file' package is a widely used utility in Unix-like operating systems that determines the type of a file based on its content rather than its name. It is essential for various applications, including file management and data processing. However, the package has been found to have a vulnerability that could lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2019-18218 is rooted in the 'cdf_read_property_info' function within the 'cdf.c' file of the 'file' package, specifically versions up to 5.37. This flaw allows an attacker to exploit a heap-based buffer overflow due to the lack of restrictions on the number of CDF_VECTOR elements. The consequences of this vulnerability include potential arbitrary code execution, data corruption, and system crashes, making it critical for users to apply the necessary fixes.
How To Fix
Minimum fixed version
5.37-r1
This is the first release that contains the fix.
sudo apk add --upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input files processed by the 'file' command to avoid triggering the vulnerability until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2019-18218 vulnerability in the 'file' package poses a significant risk due to its potential for heap-based buffer overflow. Users are strongly advised to update to the patched version 5.37-r1 to secure their systems. For ongoing monitoring of vulnerabilities, consider using Vulert, which provides real-time alerts based on your manifest files.
See every vulnerability recorded for file →
FAQ
CVE-2019-18218 is a vulnerability in the 'file' package that allows for a heap-based buffer overflow due to improper handling of CDF_VECTOR elements.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The risks include potential arbitrary code execution, data corruption, and system instability, which can lead to significant security breaches.
Yes, a patch is available in version 5.37-r1 of the 'file' package. Users should update to this version or later to mitigate the risk.
If immediate updating is not possible, limit the use of the 'file' command on untrusted files as a temporary workaround until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for file.
