Executive brief
ImageMagick is a widely used software suite for editing and converting digital images. A vulnerability in how it handles image metadata (EXIF profiles) allows an attacker to crash applications using the library by providing a specially crafted image file. This can lead to a denial of service, potentially disrupting automated image processing workflows or web services that allow user-uploaded content.
Technical details
An out-of-bounds read vulnerability exists in MagickCore/profile.c within ImageMagick's SyncExifProfile function. The root cause is an insufficient validation of the 'format' field read from an EXIF profile; specifically, the code failed to check for negative values before using the variable to index the 'format_bytes' global array. A remote attacker can exploit this by providing a maliciously crafted image file that, when processed by tools like 'identify' or 'mogrify', triggers a global buffer overflow (read). This results in an application crash (denial of service). The issue was addressed in versions 7.0.3-2 and 6.9.6-0 by adding a bounds check for the format variable.
Affected products
- ImageMagick ImageMagick < 7.0.3-2, < 6.9.6-0
Timeline
- 2016-09-30: disclosed: Issue reported on GitHub by Marco Grassi
- 2016-10-01: patched: Fix committed to ImageMagick repository
- 2017-01-18: advisory: NVD publication date
References
- http://www.debian.org/security/2016/dsa-3726
- http://www.openwall.com/lists/oss-security/2016/10/01/4
- http://www.openwall.com/lists/oss-security/2016/10/01/6
- http://www.securityfocus.com/bid/93264
- https://github.com/ImageMagick/ImageMagick/commit/a7bb158b7bedd1449a34432feb3a67c8f1873bfa
- https://github.com/ImageMagick/ImageMagick/issues/280
- https://security.gentoo.org/glsa/201611-21