|
Brought to you by:
Suppliers of:
|
|
|
| |
ImageMagick provides "a variety of graphics image-handling libraries and capabilities. These libraries are widely used and are shipped by default on most Unix and Linux distributions. These libraries are commonly installed by default on computers where any other graphical image viewer or X Desktop environment is installed (such as Gnome or KDE)".
Remote exploitation of a buffer overflow vulnerability in the ImageMagick's Project's ImageMagick PSD image-decoding module could allow an attacker to execute arbitrary code. |
| |
Credit:
The information has been provided by iDEFENSE. The vulnerability has been discovered by Andrei Nigmatulin.
The original article can be found at: http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities&flashstatus=true
|
| |
Vulnerable Systems:
* ImageMagick version 6.1.7 and prior
Immune Systems:
* ImageMagick version 6.1.8-8 or newer
A heap overflow exists within ImageMagick, specifically in the decoding of Photoshop Document (PSD) files. The vulnerable code follows:
ImageMagick-6.1.0/coders/psd.c
for (j=0; j < (long) layer_info[i].channels; j++)
{
layer_info[i].channel_info[j].type=(short)ReadBlobMSBShort(image);
layer_info[i].channel_info[j].size=ReadBlobMSBLong(image);
[...]
}
The array channel_info is only 24 elements large, and the loop variable, "j", is bounded by a user-supplied value from the image file, thus allowing a heap overflow to occur when more than 24 layers are specified. If heap structures are overflowed in a controlled way, execution of arbitrary code is possible.
Analysis:
Exploitation may allow attackers to run arbitrary code on a victim's computer if the victim opens a specially formatted image. Such images could be delivered by e-mail or HTML, in some cases, and would likely not raise suspicion on the victim's part. Exploitation is also possible when a web-based application uses ImageMagick to process user-uploaded image files.
Vendor response:
This vulnerability is addressed in ImageMagick 6.1.8-8, available for download at: http://www.imagemagick.org/www/download.html
CVE Information:
CAN-2005-0005
Disclosure timeline:
12/21/2004 - Initial vendor notification
01/14/2004 - Initial vendor response
01/17/2005 - Public disclosure
|
|
|
|
|
