Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and possibly earlier versions allows remote attackers to execute arbitrary code via a .PSD image file with a large number of layers.

Andrei Nigmatulin discovered a potential buffer overflow in the PhotoShop Document image decoding function of ImageMagick. Decoding a malicious PSD image which specifies more than the allowed 24 channels might result in execution of arbitrary code with the user's privileges.

Since ImageMagick can be used in custom printing systems, this also might lead to privilege escalation (execute code with the printer spooler's privileges). However, Ubuntu's standard printing system does not use ImageMagick, thus there is no risk of privilege escalation in a standard installation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the ImageMagick image handler. An attacker could create a carefully crafted Photoshop Document (PSD) image in such a way that it would cause ImageMagick to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0005 to this issue.

A format string bug was found in the way ImageMagick handles filenames. An attacker could execute arbitrary code in a victims machine if they are able to trick the victim into opening a file with a specially crafted name. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0397 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An iDEFENSE Security Advisory reports :

Remote exploitation of a buffer overflow vulnerability in The ImageMagick's Project's ImageMagick PSD image-decoding module could allow an attacker to execute arbitrary code.

Exploitation may allow attackers to run arbitrary code on a victim's computer if the victim opens a specially formatted image. Such images could be delivered by e-mail or HTML, in some cases, and would likely not raise suspicion on the victim's part. Exploitation is also possible when a web-based application uses ImageMagick to process user-uploaded image files.

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the ImageMagick image handler. An attacker could create a carefully crafted Photoshop Document (PSD) image in such a way that it would cause ImageMagick to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0005 to this issue.

A format string bug was found in the way ImageMagick handles filenames. An attacker could execute arbitrary code in a victims machine if they are able to trick the victim into opening a file with a specially crafted name. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0397 to this issue.

A bug was found in the way ImageMagick handles TIFF tags. It is possible that a TIFF image file with an invalid tag could cause ImageMagick to crash.

A bug was found in ImageMagick's TIFF decoder. It is possible that a specially crafted TIFF image file could cause ImageMagick to crash.

A bug was found in the way ImageMagick parses PSD files. It is possible that a specially crafted PSD file could cause ImageMagick to crash.

A heap overflow bug was found in ImageMagick's SGI parser. It is possible that an attacker could execute arbitrary code by tricking a user into opening a specially crafted SGI image file.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A format string vulnerability was discovered in ImageMagick, in the way it handles filenames. An attacker could execute arbitrary code on a victim's machine provided they could trick them into opening a file with a special name (CVE-2005-0397).

As well, Andrei Nigmatulin discovered a heap-based buffer overflow in ImageMagick's image handler. An attacker could create a special PhotoShop Document (PSD) image file in such a way that it would cause ImageMagick to execute arbitrary code when processing the image (CVE-2005-0005).

Other vulnerabilities were discovered in ImageMagick versions prior to 6.0 :

A bug in the way that ImageMagick handles TIFF tags was discovered. It was possible that a TIFF image with an invalid tag could cause ImageMagick to crash (CVE-2005-0759).

A bug in ImageMagick's TIFF decoder was discovered where a specially- crafted TIFF image could cause ImageMagick to crash (CVE-2005-0760).

A bug in ImageMagick's PSD parsing was discovered where a specially- crafted PSD file could cause ImageMagick to crash (CVE-2005-0761).

Finally, a heap overflow bug was discovered in ImageMagick's SGI parser. If an attacker could trick a user into opening a specially- crafted SGI image file, ImageMagick would execute arbitrary code (CVE-2005-0762).

The updated packages have been patched to correct these issues.

Updated ImageMagick packages that fix a heap based buffer overflow are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System.

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the ImageMagick image handler. An attacker could create a carefully crafted Photoshop Document (PSD) image in such a way that it would cause ImageMagick to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0005 to this issue.

A format string bug was found in the way ImageMagick handles filenames. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a file with a specially crafted name. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0397 to this issue.

A bug was found in the way ImageMagick handles TIFF tags. It is possible that a TIFF image file with an invalid tag could cause ImageMagick to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0759 to this issue.

A bug was found in ImageMagick's TIFF decoder. It is possible that a specially crafted TIFF image file could cause ImageMagick to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0760 to this issue.

A bug was found in the way ImageMagick parses PSD files. It is possible that a specially crafted PSD file could cause ImageMagick to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0761 to this issue.

A heap overflow bug was found in ImageMagick's SGI parser. It is possible that an attacker could execute arbitrary code by tricking a user into opening a specially crafted SGI image file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0762 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches, and are not vulnerable to these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:071 advisory.

  - security flaw (CVE-2005-0005)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200501-37 (GraphicsMagick: PSD decoding heap overflow)

    Andrei Nigmatulin discovered that handling a Photoshop Document     (PSD) file with more than 24 layers in ImageMagick could trigger a heap     overflow (GLSA 200501-26). GraphicsMagick is based on the same code and     therefore suffers from the same flaw.
  Impact :

    An attacker could potentially design a malicious PSD image file to     cause arbitrary code execution with the permissions of the user running     GraphicsMagick.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200501-26 (ImageMagick: PSD decoding heap overflow)

    Andrei Nigmatulin discovered that a Photoshop Document (PSD) file     with more than 24 layers could trigger a heap overflow.
  Impact :

    An attacker could potentially design a mailicous PSD image file to     cause arbitrary code execution with the permissions of the user running     ImageMagick.
  Workaround :

    There is no known workaround at this time.

Andrei Nigmatulin discovered a buffer overflow in the PSD image-decoding module of ImageMagick, a commonly used image manipulation library. Remote exploitation with a carefully crafted image could lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
20681	Ubuntu 4.10 : imagemagick vulnerability (USN-62-1)	Nessus	Ubuntu Local Security Checks	high
19628	Fedora Core 3 : ImageMagick-6.2.0.7-2.fc3 (2005-235)	Nessus	Fedora Local Security Checks	high
18944	FreeBSD : ImageMagick -- PSD handler heap overflow vulnerability (597e2bee-68ea-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18316	Fedora Core 2 : ImageMagick-6.2.0.7-2.fc2 (2005-234)	Nessus	Fedora Local Security Checks	high
17677	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2005:065)	Nessus	Mandriva Local Security Checks	high
17621	RHEL 2.1 / 3 : ImageMagick (RHSA-2005:070)	Nessus	Red Hat Local Security Checks	high
17179	RHEL 4 : ImageMagick (RHSA-2005:071)	Nessus	Red Hat Local Security Checks	high
16428	GLSA-200501-37 : GraphicsMagick: PSD decoding heap overflow	Nessus	Gentoo Local Security Checks	high
16417	GLSA-200501-26 : ImageMagick: PSD decoding heap overflow	Nessus	Gentoo Local Security Checks	high
16213	Debian DSA-646-1 : imagemagick - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0005

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high