SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Multimedia)  >   ImageMagick Vendors:   ImageMagick.org
ImageMagick ReadSGIImage() Heap Overflow Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016699
SecurityTracker URL:  http://securitytracker.com/id/1016699
CVE Reference:   CVE-2006-4144   (Links to External Site)
Updated:  Aug 24 2006
Original Entry Date:  Aug 15 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.x up to and including 6.2.8
Description:   A vulnerability was reported in ImageMagick. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted SGI image file that, when loaded by the target user, will trigger a heap overflow in the ReadSGIImage() function and execute arbitrary code on the target user's system. The flaw resides in 'coders/sgi.c'.

Damian Put reported this vulnerability.

The original advisory is available at:

http://www.overflow.pl/adv/imsgiheap.txt

A demonstration exploit is available at:

http://overflow.pl/poc/imheap.sgi

Impact:   A remote user can create an image file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fixed version (6.2.9).
Vendor URL:  www.imagemagick.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Aug 24 2006 (Red Hat Issues Fix) ImageMagick ReadSGIImage() Heap Overflow Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, and 4.



 Source Message Contents

Subject:  [Full-disclosure] [Overflow.pl] ImageMagick ReadSGIImage() Heap

Overflow.pl Security Advisory #7

ImageMagick ReadSGIImage() Heap Overflow

Vendor: ImageMagick (http://www.imagemagick.org)
Affected version: 6.x up to and including 6.2.8
Vendor status: Fixed version released (6.2.9)

Author: Damian Put <pucik@overflow.pl>
URL: http://www.overflow.pl/adv/imsgiheap.txt
Date: 14.08.2006


1. Background

ImageMagick is a free software suite to create, edit, and compose bitmap images.
 It can read, convert and write images in a large variety of formats.

http://www.imagemagick.org


2. Description

Remote exploitation of a heap overflow vulnerability could allow execution of
arbitrary code or couse denial of service.

A heap overflow exists in ReadSGIImage() function, that is used to
decode a SGI image file. The vulnerable code is:


coders/sgi.c:

static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
{
...
    iris_info.bytes_per_pixel=(unsigned char) ReadBlobByte(image);
...
    image->columns=iris_info.columns;
    image->rows=iris_info.rows;
...
    bytes_per_pixel=(size_t) iris_info.bytes_per_pixel;
    number_pixels=(MagickSizeType) iris_info.columns*iris_info.rows;
...
    iris_pixels=(unsigned char *)AcquireMagickMemory
(4*bytes_per_pixel*iris_info.columns*iris_info.rows); 



We can manipalute iris_info.rows, iris_info.columns and bytes_per_pixel
value. Allocation of memory to "iris_pixels" is based on this values.
When rows*cols*bytes_per_pixe*4 overflow integer variable, we can alloc not
enough memory for next operations, and cause heap overflow.


3. PoC

Example crafted SGI file: http://overflow.pl/poc/imheap.sgi

[pucik@overflow ImageMagick-6.2.8]$ display imheap.sgi
*** glibc detected *** free(): invalid next size (fast): 0x08055dd0 ***
Abort (core dumped) 
[pucik@overflow ImageMagick-6.2.8]$ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC