Re: Gentoo ImageMagick BMP image buffer overflow

On Thu, 9 Sep 2004, Albert Chin wrote:

> Is GM also vulnerable:
>  http://www.gentoo.org/security/en/glsa/glsa-200409-12.xml
>  http://studio.imagemagick.org/pipermail/magick-developers/2004-August/002011.html

I should mention that GM is *not* security software.  GM is a very 
complex package with lots of user-friendly features.  For example, the 
header magic tests take precedence over the file extension.  This 
means that if there is a security flaw in a file format, it could be 
exploited by uploading a file with a presumed "safe" extension, but 
with a header indicating the other format.  There is also the ability 
to prefix the file name with a format specifier.  If the outsider has 
the ability to provide the format specifier and commands to execute, 
then they could specify something like "txt:/etc/passwd" to retrieve 
/etc/passwd rendered as an image.

When executing GM in an environment where security is an issue (i.e. 
input comes from untrusted sources) please make sure that GM is run 
with minimal privileges, and run it under chroot or in a FreeBSD 
"jail" to make sure that files are not accessed which shouldn't be.

Bob
======================================
Bob Friesenhahn
[email protected]
http://www.simplesystems.org/users/bfriesen


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM. 
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php