Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request for imagemagick bug
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 03 Sep 2013 13:37:29 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/29/2013 05:24 PM, Bastien ROUCARIES wrote:
The gif handling code of imagemagick allow execution of arbitrary
code due to a buffer overflow of one byte. Gif image format is made
of different kind of data unit called block and these block may
appear at anytime. The code actually do the equivalent of
a=malloc(length+count) [line 1 of the patch] and
a[length+count]='\0' for each comment block [line 11 of patch]. 
Because this code is executed for every comment block and that an 
attacker could put arbitrary block between each comment block, and 
finaly this attacker could smash memory particularly on
architecture where malloc layout is predictable. Worst the bug
could be exploited remotly throught php-magick or perlmagick. A
special image leading to malloc space corruption and thus a dos is
available.

Imagemagick before version 6.7.8-8 are affected.

See upstream bug report here: 
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921

 First reported as a dos here: 
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248

Fixed by commit: 
http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c

 Analysis by myself


Please use CVE-2013-4298  for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJSJjp5AAoJEBYNRVNeJnmTW8IP/19g8bncqMvQq1HH8yd9/WGP
vZnrAlZOS8lPT/MeUQVVgOz9ft6Lyl1JDMIuFhL4zN0/pDDIvIO16ztd6kt71zHP
OMRt7Zi544d7galikjelje7RTEYJoWFUhRoBaAT6NDmEY61s6QtxKD1jUIZYlOU1
kXANs3THmQSrYI/sV9v+uZ4GH9jq/2g9iSSnO0H/sWoSe0m9YvI6k1q/Y2bRoUN1
laTqd2HSAYk4yy/q2PnlC4Coxh1PfadSYD+eMmJvXV5XVZMd/QhQxfGPYW35/YjZ
L/yXB4ur93cNax6E6Jc9dx5SM6l74I9SXsOGhvRA8r51p2jkOEdnyubNljmEpP09
tbDdzosJ2uslK3gN38fiaiwLITpT5DA+weTQ01J1CJBNbBeg3ZXBChukbUlhfdnM
K9jEoTj44GeJb5SWhG0lL26XWucExzdfVB+5SuX5Wle89BYQagzgyL6x1IoIugrO
vrOkSGEtwgQCvQlQByLGh5Qe+2h9hcbLd1sEv9gCHvhYeP7jEt5pAG7EP/UGPvBT
u0MQCND3ZSbtVkVFDo2LzgwkP2xZMJ/RRTdhyTnmnUp+Mp1A2k7AxysPr6VxDsr+
AT3kNuqpTUt8irkFZiTlcU767Y/SNM/nEaARbbyCs4zvu/nqSfEym91/RiwaEULN
sO4B9uKmJU3exYitJCCa
=JzSv
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault