CVE-2014-3587

What it actually does

Integer overflow in cdf_read_property_info within cdf.c allows a malformed CDF file to trigger memory corruption that crashes the parsing process.

Why it matters to the business

Applications that inspect file types with the vulnerable library or PHP Fileinfo component can be crashed by a single specially crafted file, causing service outages and requiring restarts until the component is updated.

How an attack unfolds

An attacker crafts a CDF file that triggers the integer overflow during property-info parsing, then delivers it to any service that uses the vulnerable file utility or PHP Fileinfo extension to inspect uploaded or processed files, resulting in an immediate denial-of-service crash.

How to fix it

Upgrade the file library to version 5.20 or later and PHP to 5.4.32 or 5.5.16 or later; rebuild any components that statically link the library; disable CDF parsing where the capability is not required.

How to confirm the fix worked

Confirm the installed file and PHP versions are at or above the fixed releases; run the application's file-type inspection against a known-good CDF corpus and a test case that previously triggered the crash.

Typical attack path

1. Identify a target service that inspects CDF or Office files via the vulnerable library or PHP Fileinfo
2. Generate or obtain a crafted CDF file that exercises the integer overflow
3. Upload or submit the file through the application's normal file-handling path
4. Trigger parsing of the file metadata, causing the crash

How to detect it

Review application and system logs for abrupt crashes or segmentation faults occurring during file-type inspection or PHP Fileinfo calls on CDF or Office documents; correlate with upload or processing timestamps of untrusted files.

What your security team should do

• Patch the file library and PHP Fileinfo component to fixed versions immediately
• Scan all systems for the vulnerable versions and prioritize internet-facing services
• Add file-type inspection to application hardening reviews and consider sandboxing or disabling unnecessary parsers