Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a filename argument to convert, which may be called by other web applications.

Tavis Ormandy discovered a format string vulnerability in ImageMagick's file name handling. Specially crafted file names could cause a program using ImageMagick to crash, or possibly even cause execution of arbitrary code.

Since ImageMagick can be used in custom printing systems, this also might lead to privilege escalation (execute code with the printer spooler's privileges). However, Ubuntu's standard printing system does not use ImageMagick, thus there is no risk of privilege escalation in a standard installation.

ImageMagick is also commonly used by web frontends; if these accept image uploads with arbitrary file names, this could also lead to remote privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy reports :

magemagick-6.2.0-3 fixes an potential issue handling malformed filenames, the flaw may affect webapps or scripts that use the imagemagick utilities for image processing, or applications linked with libMagick.

This vulnerability could crash ImageMagick or potentially lead to the execution of arbitrary code with the permissions of the user running ImageMagick.

A format string vulnerability was discovered in ImageMagick, in the way it handles filenames. An attacker could execute arbitrary code on a victim's machine provided they could trick them into opening a file with a special name (CVE-2005-0397).

As well, Andrei Nigmatulin discovered a heap-based buffer overflow in ImageMagick's image handler. An attacker could create a special PhotoShop Document (PSD) image file in such a way that it would cause ImageMagick to execute arbitrary code when processing the image (CVE-2005-0005).

Other vulnerabilities were discovered in ImageMagick versions prior to 6.0 :

A bug in the way that ImageMagick handles TIFF tags was discovered. It was possible that a TIFF image with an invalid tag could cause ImageMagick to crash (CVE-2005-0759).

A bug in ImageMagick's TIFF decoder was discovered where a specially- crafted TIFF image could cause ImageMagick to crash (CVE-2005-0760).

A bug in ImageMagick's PSD parsing was discovered where a specially- crafted PSD file could cause ImageMagick to crash (CVE-2005-0761).

Finally, a heap overflow bug was discovered in ImageMagick's SGI parser. If an attacker could trick a user into opening a specially- crafted SGI image file, ImageMagick would execute arbitrary code (CVE-2005-0762).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in ImageMagick, a commonly used image manipulation library. These problems can be exploited by a carefully crafted graphic image. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-0397     Tavis Ormandy discovered a format string vulnerability     in the filename handling code which allows a remote     attacker to cause a denial of service and possibly     execute arbitrary code.

  - CAN-2005-0759

    Andrei Nigmatulin discovered a denial of service     condition which can be caused by an invalid tag in a     TIFF image.

  - CAN-2005-0760

    Andrei Nigmatulin discovered that the TIFF decoder is     vulnerable to accessing memory out of bounds which will     result in a segmentation fault.

  - CAN-2005-0762

    Andrei Nigmatulin discovered a buffer overflow in the     SGI parser which allows a remote attacker to execute     arbitrary code via a specially crafted SGI image file.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:320 advisory.

  - security flaw (CVE-2005-0397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated ImageMagick packages that fix a heap based buffer overflow are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick is an image display and manipulation tool for the X Window System.

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the ImageMagick image handler. An attacker could create a carefully crafted Photoshop Document (PSD) image in such a way that it would cause ImageMagick to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0005 to this issue.

A format string bug was found in the way ImageMagick handles filenames. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a file with a specially crafted name. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0397 to this issue.

A bug was found in the way ImageMagick handles TIFF tags. It is possible that a TIFF image file with an invalid tag could cause ImageMagick to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0759 to this issue.

A bug was found in ImageMagick's TIFF decoder. It is possible that a specially crafted TIFF image file could cause ImageMagick to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0760 to this issue.

A bug was found in the way ImageMagick parses PSD files. It is possible that a specially crafted PSD file could cause ImageMagick to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0761 to this issue.

A heap overflow bug was found in ImageMagick's SGI parser. It is possible that an attacker could execute arbitrary code by tricking a user into opening a specially crafted SGI image file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0762 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain backported patches, and are not vulnerable to these issues.

The remote host is missing the patch for the advisory SUSE-SA:2005:017 (ImageMagick).


This update fixes several security issues in the ImageMagick program suite:

- A format string vulnerability was found in the display program which could lead to a remote attacker being to able to execute code as the user running display by providing handcrafted filenames of images. This is tracked by the Mitre CVE ID CVE-2005-0397.

Andrei Nigmatulin reported 4 problems in older versions of ImageMagick:

- A bug was found in the way ImageMagick handles TIFF tags.
It is possible that a TIFF image file with an invalid tag could cause ImageMagick to crash.
This is tracked by the Mitre CVE ID CVE-2005-0759.

Only ImageMagick version before version 6 are affected.

- A bug was found in ImageMagick's TIFF decoder.
It is possible that a specially crafted TIFF image file could cause ImageMagick to crash.
This is tracked by the Mitre CVE ID CVE-2005-0760.

Only ImageMagick version before version 6 are affected.

- A bug was found in the way ImageMagick parses PSD files.
It is possible that a specially crafted PSD file could cause ImageMagick to crash.
This is tracked by the Mitre CVE ID CVE-2005-0761.

Only ImageMagick version before version 6.1.8 are affected.

- A heap overflow bug was found in ImageMagick's SGI parser.
It is possible that an attacker could execute arbitrary code by tricking a user into opening a specially crafted SGI image file.
This is tracked by the Mitre CVE ID CVE-2005-0762.

Only ImageMagick version before version 6 are affected.

The remote host is affected by the vulnerability described in GLSA-200503-11 (ImageMagick: Filename handling vulnerability)

    Tavis Ormandy of the Gentoo Linux Security Audit Team has identified a     flaw in the handling of filenames by the ImageMagick utilities.
  Impact :

    Successful exploitation may disrupt web applications that depend on     ImageMagick for image processing, potentially executing arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
20716	Ubuntu 4.10 : imagemagick vulnerability (USN-90-1)	Nessus	Ubuntu Local Security Checks	high
18980	FreeBSD : ImageMagick -- format string vulnerability (713c3913-8c2b-11d9-b58c-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
17677	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2005:065)	Nessus	Mandriva Local Security Checks	high
17673	Debian DSA-702-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	high
17623	RHEL 4 : ImageMagick (RHSA-2005:320)	Nessus	Red Hat Local Security Checks	high
17621	RHEL 2.1 / 3 : ImageMagick (RHSA-2005:070)	Nessus	Red Hat Local Security Checks	high
17606	SUSE-SA:2005:017: ImageMagick	Nessus	SuSE Local Security Checks	high
17283	GLSA-200503-11 : ImageMagick: Filename handling vulnerability	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-0397

high

Tenable Plugins

high

high

high

high

high

high

high

high