CVE-2013-7345

What it actually does

The BEGIN regex in the awk script detector uses multiple wildcards with unlimited repetitions, enabling catastrophic backtracking on crafted input containing many newline characters and resulting in excessive CPU consumption.

Why it matters to the business

Attackers can remotely trigger high CPU usage that disrupts file identification services, slows down scanning workflows, and may lead to resource exhaustion on systems that process untrusted files.

How an attack unfolds

An attacker crafts an ASCII file containing a large number of newline characters and submits it to any process that invokes the file command or its library; the regex engine in the awk detector enters repeated backtracking, consuming CPU until the process is terminated or the system becomes unresponsive.

How to fix it

Upgrade the file utility to version 5.15 or later on all affected systems; where upgrades are unavailable, implement strict input validation or sandboxing around file-type detection of untrusted content.

How to confirm the fix worked

Verify installed version is 5.15 or newer; test with a file containing 10,000+ consecutive newlines and confirm CPU usage remains bounded.

Typical attack path

1. Identify a service or script that invokes the file command or libmagic on attacker-controlled content
2. Generate an ASCII file containing thousands of consecutive newline characters
3. Submit the crafted file through the normal input path (upload, email attachment, network share)
4. Observe sustained high CPU usage on the target process until manual intervention or timeout

How to detect it

Review system and application logs for repeated invocations of the file command or PHP fileinfo functions processing files with unusually high newline counts; correlate with process CPU metrics showing sustained 100% usage on file-related workers.

What your security team should do

• Prioritize upgrade of the file package to 5.15+ across all Linux distributions and PHP deployments
• Add monitoring for sustained high CPU by the file command or PHP fileinfo module
• Restrict file-type detection to trusted or sandboxed contexts until patches are applied