CVE-2014-3478 in Mac OS X
Summary
by MITRE
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/04/2025
The vulnerability identified as CVE-2014-3478 represents a critical buffer overflow flaw within the file command's magic file processing functionality. This issue specifically affects the mconvert function in softmagic.c, which handles FILE_PSTRING conversion operations. The vulnerability exists in file versions prior to 5.19 and impacts PHP installations before 5.4.30 and 5.5.x versions before 5.5.14, making it a widespread concern across multiple PHP version lines. The flaw occurs when processing crafted Pascal strings during FILE_PSTRING conversion, creating a scenario where malicious input can overwrite adjacent memory regions beyond the intended buffer boundaries. This vulnerability falls under the CWE-121 buffer overflow category, specifically classified as a stack-based buffer overflow that can lead to arbitrary code execution or application crashes.
The technical exploitation of this vulnerability requires a remote attacker to craft a specially formatted Pascal string that triggers the buffer overflow condition during the file type detection process. When PHP's Fileinfo component processes a file containing such malicious input, the mconvert function fails to properly validate the string length before copying data into a fixed-size buffer. This allows the attacker to overwrite adjacent memory locations, potentially corrupting program execution flow and causing the application to crash. The vulnerability is particularly dangerous because it can be triggered through normal file type detection operations, meaning that any application using PHP's Fileinfo extension could be affected simply by processing untrusted file inputs. The attack vector is classified as network-based remote exploitation, as attackers can deliver malicious files through web applications, file upload handlers, or any interface that utilizes PHP's file type detection capabilities.
The operational impact of CVE-2014-3478 extends beyond simple denial of service conditions to potentially enable more sophisticated attacks. While the immediate effect is application crash and service disruption, the buffer overflow condition creates opportunities for attackers to execute arbitrary code on affected systems. This makes the vulnerability particularly dangerous in web server environments where PHP applications process user-uploaded files. The vulnerability affects a wide range of applications including content management systems, file sharing platforms, and web applications that rely on PHP's Fileinfo extension for file type validation. Attackers can leverage this flaw to compromise server integrity, leading to complete system takeover in cases where the overflow allows for code execution. The vulnerability also impacts the availability of services since successful exploitation results in application crashes and requires system restarts to restore normal operations.
Mitigation strategies for CVE-2014-3478 focus on immediate patching and input validation measures. Organizations should prioritize upgrading to PHP versions 5.4.30 or later, or 5.5.14 and later, which contain the necessary fixes for this vulnerability. Additionally, implementing strict input validation for file type detection operations can help prevent exploitation by sanitizing file inputs before they reach the vulnerable code path. Network-level protections such as web application firewalls can be configured to detect and block suspicious file type detection requests. The vulnerability also highlights the importance of maintaining up-to-date file command installations and implementing proper security monitoring for application crashes. Organizations should consider implementing application sandboxing techniques and privilege separation to limit the potential damage from successful exploitation attempts. From an ATT&CK framework perspective, this vulnerability maps to the T1059 command and script injection techniques, as exploitation may involve injecting malicious code through the buffer overflow mechanism, and T1499 endpoint denial of service, as the primary impact is service disruption through application crashes.