Heap-based buffer overflow in the ReadPNMImage function in pnm.c for ImageMagick 6.2.1 and earlier allows remote attackers to cause a denial of service (application crash) via a PNM file with a small colors value.

Updated ImageMagick packages that fix a buffer overflow issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System which can read and write multiple image formats.

A heap based buffer overflow bug was found in the way ImageMagick parses PNM files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted PNM file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1275 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue.

Damian Put discovered a buffer overflow in the PNM image decoder.
Processing a specially crafted PNM file with a small 'colors' value resulted in a crash of the application that used the ImageMagick library. (CAN-2005-1275)

Another Denial of Service vulnerability was found in the XWD decoder.
Specially crafted invalid color masks resulted in an infinite loop which caused the application using the ImageMagick library to stop working and use all available CPU resources.
(http://bugs.gentoo.org/show_bug.cgi?id=90423)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Damian Put reports about ImageMagick :

Remote exploitation of a heap overflow vulnerability could allow execution of arbitrary code or course denial of service.

A heap overflow exists in ReadPNMImage() function, that is used to decode a PNM image files.

A heap-based buffer overflow was found in the way that ImageMagick parses PNM files. If an attacker can trick a victim into opening a specially crafted PNM file, the attacker could execute arbitrary code on the victim's machine (CVE-2005-1275).

As well, a Denial of Service vulnerability was found in the way that ImageMagick parses XWD files. If a user or program executed ImageMagick to process a malicious XWD file, ImageMagick will enter info an infinite loop causing a DoS (CVE-2005-1739).

The updated packages have been patched to fix these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:413 advisory.

    ImageMagick(TM) is an image display and manipulation tool for the X Window     System which can read and write multiple image formats.

    A heap based buffer overflow bug was found in the way ImageMagick parses     PNM files. An attacker could execute arbitrary code on a victim's machine     if they were able to trick the victim into opening a specially crafted PNM     file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-1275 to this issue.

    Users of ImageMagick should upgrade to these updated packages, which     contain a backported patch, and are not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
21821	CentOS 3 / 4 : ImageMagick (CESA-2005:413)	Nessus	CentOS Local Security Checks	medium
20523	Ubuntu 4.10 / 5.04 : imagemagick vulnerabilities (USN-132-1)	Nessus	Ubuntu Local Security Checks	medium
19125	FreeBSD : ImageMagick -- ReadPNMImage() heap overflow vulnerability (cd286cc5-b762-11d9-bfb7-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
18584	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2005:107)	Nessus	Mandriva Local Security Checks	medium
18385	RHEL 4 : ImageMagick (RHSA-2005:413)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-1275

medium

Tenable Plugins

medium

medium

medium

medium

medium