logo
DATABASE RESOURCES PRICING ABOUT US

ImageMagick -- multiple vulnerabilities

Description

Openwall reports: Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats. Any service which uses ImageMagick to process user supplied images and uses default delegates.xml / policy.xml, may be vulnerable to this issue. It is possible to make ImageMagick perform a HTTP GET or FTP request It is possible to delete files by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading. It is possible to move image files to file with any extension in any folder by using ImageMagick's 'msl' pseudo protocol. msl.txt and image.gif should exist in known location - /tmp/ for PoC (in real life it may be web service written in PHP, which allows to upload raw txt files and process images with ImageMagick). It is possible to get content of the files from the server by using ImageMagick's 'label' pseudo protocol.


Affected Package


OS OS Version Package Name Package Version
FreeBSD any imagemagick 6.9.3.9_1,1
FreeBSD any imagemagick-nox11 6.9.3.9_1,1
FreeBSD any imagemagick7 7.0.0.0.b20150715
FreeBSD any imagemagick7 7.0.1.0_1
FreeBSD any imagemagick7-nox11 7.0.0.0.b20150715
FreeBSD any imagemagick7-nox11 7.0.1.0_1

Related