Re: Patches for security issues and other problems.

On Tue, 3 Jan 2006, Daniel Kobras wrote:
> While preparing Debian packages of graphicsmagick, I noticed that some
> of ImageMagick's recent vulnerabilities are not (or not completely)
> fixed in GraphicsMagick. These are

Thanks for the patches.

> * CVE-2005-4601 (Shell command injection in delegate code)

The command delegate interface has never been very secure. 
Unfortunately, it is also very complicated since it supports 
recursion.

>  This security bug is very recent, and I'm not aware of any attempts to
>  fix it. I've confirmed that it also affects GraphicsMagick. While
>  there are security concerns only when GraphicsMagick tools are used as
>  helpers from other applications like mail clients, it's still a bug
>  to treat filenames differently depending on whether there is an
>  external delegate involved or not. See http://bugs.debian.org/345238
>  for more details. (The demo "exploit" using wmf files fails when
>  GraphicsMagick was built with libwmf support. dvi files worked for me,
>  though.)
>  I don't see a quick and simple way to plug this hole, unfortunately.
>  Disallowing '"' in filenames is the quick and dirty way but obviously
>  suboptimal. Escaping shell metacharacters needs someone more familiar
>  with the code then me to identify all the right places, otherwise we
>  might end up with escaping once too often, even when the filename
>  isn't passed through shell expansion later on. I've also been thinking
>  about changing format specifiers from %i, %o etc. to $i, $o and pass
>  substitutions values through environment variables. This might have
>  unwanted side effects, but maybe we might still choose to try is
>  anyway. What's your opinion on this problem?

I will study the problem further.  There are many related issues to be 
concerned about.  For example, the search order/criteria for 
delegates.mgk is quite important.  Some versions of IM have checked 
the current directory first (or a user's home directory) for 
delegates.mgk, which means that a bogus delegates.mgk can be provided 
containing arbitrary commands.  The "installed" version of GM always 
uses the formally installed delegates.mgk first, but the 
MAGICK_CONFIGURE_PATH environment variable can be used to override 
that.  The "uninstalled" version of GM is not as secure.

The MVG format (Magick Vector Graphics) format is not very secure 
since it is possible to execute delegate commands and read arbitrary 
files on the system.  Due to this, automatic detection of MVG files 
was removed from GM some time ago.

> * Stage 1 of the ttf/read.t regression test for the Perl bindings fails
>  for me because the fonts are rendered much smaller in the reference
>  image. Comparing with the output from current ImageMagick on the same
>  system, it looks like the font size in the reference image is
>  incorrect. But then ImageMagick also renders the first three lines
>  differently, so I'm not completely sure who's to blame here.

The reason for this is that the reference files are generated with 
TrueType glyph hinting enabled (more accurate).  That is not the 
default for FreeType due to concern over possible Apple patent 
infringement.  Even without this, the output from different 
FreeType builds varies.  You will find that even with the same version 
of FreeType, the results differ when FreeType is built on an Mac-OSX 
system (arrgh!).

> * Finally, there's a simple typo in configure.ac that leads to an empty
>  HTML delegate when running without frozen paths. Patch against 1.1.7
>  attached.

Thanks.  I will blame my cat for that one. :-)

Bob
======================================
Bob Friesenhahn
[email protected], http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click