Re: ImageMagick Is On Fire -- CVE-2016-3714

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Thu, 19 May 2016, Simon McVittie wrote:
> Having looked into it a bit for Debian, there are several factors:
>
> * mitigations exist, like you said

The problem is that most users don't know about the problem, the 
mitigations, or are even aware that they are using the software. 
They do know about periodic application of security updates.

Regarding the comments from Kurt Seifried about the supposed perils of 
MVG:

Unless ImageMagick is configured to use RSVG (as it often is), then it 
will use its own built in SVG renderer by default (the built in one is 
still available with a "MSVG:" prefix to the filename or possibly the 
file extension).  The SVG renderer operates by translating the SVG 
into MVG, including the URLs.  The translation is not secure in that 
arbitrary MVG may be injected via SVG through text strings.  SVG is a 
common file exchange format found on the web and often opened outside 
of web browsers.

> * many of the upstream fixes in ImageMagick (and GraphicsMagick)
>  are really just mitigations too, and they remove features that someone
>  could conceivably have been using, which rather goes against the idea
>  of a stable release with a fixed feature-set

Agreed.

> Bob, if you would like distributions to pick up GraphicsMagick security
> fixes in a timely way, it would probably be really useful to do an
> upstream release - distributions are typically a lot more confident about

I do plan to make a release, but want to make sure that the release is 
of no less quality than other releases.  I want to remove the current 
render/MVG "mitigation" regarding magick-specific syntax and provide a 
"safer" operating mode which protects against magick-specific syntax 
when it is used for formats with expected behavior like SVG.  The 
"safer" mode may have general purpose value outside of MVG.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/