[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE request for imagemagick bug
From:       Bastien ROUCARIES <roucaries.bastien () gmail ! com>
Date:       2013-08-29 23:24:33
Message-ID: CAE2SPAZgeLGOq+WKDgf-PTuyDn3629geBuVrWUyQjzZZhcYaoQ () mail ! gmail ! com
[Download RAW message or body]

The gif handling code of imagemagick allow execution of arbitrary code
due to a buffer overflow of one byte.
Gif image format is made of different kind of data unit called block
and these block may appear at anytime.
The code actually do the equivalent of a=malloc(length+count) [line 1
of the patch] and  a[length+count]='\0' for each comment block [line
11 of patch].
Because this code is executed for every comment block and that an
attacker could put arbitrary block between each comment block, and
finaly this attacker could smash memory particularly on architecture
where malloc layout is predictable.
Worst the bug could be exploited remotly throught php-magick or perlmagick.
A special image leading to malloc space corruption and thus a dos is available.

Imagemagick before version 6.7.8-8 are affected.

See upstream bug report here:
http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921

First reported as a dos here:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248

Fixed by commit:
http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c

Analysis by myself
[prev in list] [next in list] [prev in thread] [next in thread]