CVE-2015-2325
📋 TL;DR
This vulnerability in PCRE (Perl Compatible Regular Expressions) library allows attackers to cause heap memory corruption by crafting malicious regular expressions. When exploited, it can lead to denial of service (crash) or potentially arbitrary code execution. Any application using vulnerable PCRE versions for regex processing is affected.
💻 Affected Systems
- PCRE library
- Applications using PCRE (Exim, PHP, Apache, Nginx, security tools)
📦 What is this software?
Mariadb by Mariadb
Opensuse by Opensuse
Opensuse by Opensuse
Pcre by Pcre
Php by Php
Php by Php
Php by Php
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the application processes attacker-controlled regex patterns.
Likely Case
Denial of service through application crashes when processing malicious regex patterns.
If Mitigated
Limited impact if input validation restricts regex patterns or if affected components aren't internet-facing.
🎯 Exploit Status
Exploit requires crafting specific regex patterns with forward references and repeated groups. Public PoC exists in bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PCRE 8.37 and later
Vendor Advisory: https://www.pcre.org/original/changelog.txt
Restart Required: Yes
Instructions:
1. Update PCRE library to version 8.37 or later. 2. Recompile applications linked against PCRE. 3. Restart affected services. 4. For Linux distributions, use package manager: 'apt-get update && apt-get upgrade libpcre3' (Debian/Ubuntu) or 'yum update pcre' (RHEL/CentOS).
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize regex patterns from untrusted sources before processing
PCRE Compile-time Limits
linuxSet lower limits on regex complexity using PCRE configuration options
export PCRE_EXTRA_MATCH_LIMIT=1000000
export PCRE_EXTRA_MATCH_LIMIT_RECURSION=1000
🧯 If You Can't Patch
- Implement strict input validation to reject complex regex patterns with forward references
- Use WAF or reverse proxy to filter malicious regex patterns before reaching vulnerable applications
🔍 How to Verify
Check if Vulnerable:
Check PCRE version: 'pcre-config --version' or 'dpkg -l | grep libpcre3' on Debian/Ubuntu, 'rpm -qa | grep pcre' on RHEL/CentOSCheck Version:
pcre-config --versionVerify Fix Applied:
Verify PCRE version is 8.37 or higher and applications have been restarted📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory corruption errors in application logs
- Unusual regex processing patterns
Network Indicators:
- HTTP requests containing complex regex patterns
- Repeated connection attempts to regex-processing endpoints
SIEM Query:
source="application.log" AND ("segmentation fault" OR "heap corruption" OR "out of bounds")🔗 References
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html
- https://bugs.exim.org/show_bug.cgi?id=1591
- https://fortiguard.com/zeroday/FG-VD-15-015
- https://www.pcre.org/original/changelog.txt
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html
- https://bugs.exim.org/show_bug.cgi?id=1591
- https://fortiguard.com/zeroday/FG-VD-15-015
- https://www.pcre.org/original/changelog.txt
