SA151: ImageMagick RCE Vulnerability (ImageTragick)

SUMMARY

Symantec Network Protection products using affected versions of ImageMagick are susceptible to the ImageTragick security vulnerability. A remote attacker can send crafted images and execute arbitrary code on the target.

AFFECTED PRODUCTS

The following products are vulnerable:

Security Analytics

CVE |Affected Version(s)|Remediation
All CVEs | 7.3 | Not vulnerable, fixed in 7.3.1
7.2 | Not available at this time
7.1 | Not available at this time

ADDITIONAL PRODUCT INFORMATION

Security Analytics is only vulnerable through intercepted network traffic.

The following products are not vulnerable:
Advanced Secure Gateway
Android Mobile Agent
AuthConnector
BCAAA
Blue Coat HSM Agent for the Luna SP
CacheFlow
Client Connector
Cloud Data Protection for Salesforce
Cloud Data Protection for Salesforce Analytics
Cloud Data Protection for ServiceNow
Cloud Data Protection for Oracle CRM On Demand
Cloud Data Protection for Oracle Field Service Cloud
Cloud Data Protection for Oracle Sales Cloud
Cloud Data Protection Integration Server
Cloud Data Protection Communication Server
Cloud Data Protection Policy Builder
Content Analysis
Director
General Auth Connector Login Application
IntelligenceCenter
IntelligenceCenter Data Collector
K9
Mail Threat Defense Malware Analysis
Management Center
Norman Shark Industrial Control System Protection
PacketShaper
PacketShaper S-Series
PolicyCenter
PolicyCenter S-Series
ProxyAV
ProxyAV ConLog and ConLogXP
ProxyClient
ProxySG Reporter
SSL Visibility
Unified Agent
X-Series XOS

ISSUES

CVE-2016-3714

Severity / CVSSv2 | High / 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) References| SecurityFocus: BID 89848 / NVD: CVE-2016-3714 Impact| Code execution Description | An insufficient input validation flaw in multiple ImageMagick coders allows a remote attacker to send crafted images with injected OS shell commands. The attacker can execute arbitrary code on the target system with the privileges of the ImageMagick application.

MITIGATION

Symantec's ProxySG 6.6 and 6.7 web application firewall (WAF) solution can protect network servers against some ImageTragick attack vectors. The WAF Command Injection engine, when configured to scan HTTP requests, can block HTTP POST requests containing crafted images with injected OS commands.

REFERENCES

ImageTragick - <https://imagetragick.com/&gt;

REVISION

2019-01-17 IntelligenceCenter and IntelligenceCenter Data Collector are not vulnerable. Advisory Status moved to Closed.
2017-07-05 initial public release