ImageMagick ReadSGIImage() Heap Overflow Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016699 |
|
SecurityTracker URL: http://securitytracker.com/id/1016699
|
|
CVE Reference:
CVE-2006-4144
(Links to External Site)
|
Updated: Aug 24 2006
|
Original Entry Date: Aug 15 2006
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 6.x up to and including 6.2.8
|
Description:
A vulnerability was reported in ImageMagick. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted SGI image file that, when loaded by the target user, will trigger a heap overflow in the ReadSGIImage() function and execute arbitrary code on the target user's system. The flaw resides in 'coders/sgi.c'.
Damian Put reported this vulnerability.
The original advisory is available at:
http://www.overflow.pl/adv/imsgiheap.txt
A demonstration exploit is available at:
http://overflow.pl/poc/imheap.sgi
|
Impact:
A remote user can create an image file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued a fixed version (6.2.9).
|
Vendor URL: www.imagemagick.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Subject: [Full-disclosure] [Overflow.pl] ImageMagick ReadSGIImage() Heap
|
Overflow.pl Security Advisory #7
ImageMagick ReadSGIImage() Heap Overflow
Vendor: ImageMagick (http://www.imagemagick.org)
Affected version: 6.x up to and including 6.2.8
Vendor status: Fixed version released (6.2.9)
Author: Damian Put <pucik@overflow.pl>
URL: http://www.overflow.pl/adv/imsgiheap.txt
Date: 14.08.2006
1. Background
ImageMagick is a free software suite to create, edit, and compose bitmap images.
It can read, convert and write images in a large variety of formats.
http://www.imagemagick.org
2. Description
Remote exploitation of a heap overflow vulnerability could allow execution of
arbitrary code or couse denial of service.
A heap overflow exists in ReadSGIImage() function, that is used to
decode a SGI image file. The vulnerable code is:
coders/sgi.c:
static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
{
...
iris_info.bytes_per_pixel=(unsigned char) ReadBlobByte(image);
...
image->columns=iris_info.columns;
image->rows=iris_info.rows;
...
bytes_per_pixel=(size_t) iris_info.bytes_per_pixel;
number_pixels=(MagickSizeType) iris_info.columns*iris_info.rows;
...
iris_pixels=(unsigned char *)AcquireMagickMemory
(4*bytes_per_pixel*iris_info.columns*iris_info.rows);
We can manipalute iris_info.rows, iris_info.columns and bytes_per_pixel
value. Allocation of memory to "iris_pixels" is based on this values.
When rows*cols*bytes_per_pixe*4 overflow integer variable, we can alloc not
enough memory for next operations, and cause heap overflow.
3. PoC
Example crafted SGI file: http://overflow.pl/poc/imheap.sgi
[pucik@overflow ImageMagick-6.2.8]$ display imheap.sgi
*** glibc detected *** free(): invalid next size (fast): 0x08055dd0 ***
Abort (core dumped)
[pucik@overflow ImageMagick-6.2.8]$
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
