Executive Summary
| Summary | |
|---|---|
| Title | imagemagick security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-3580 | First vendor Publication | 2016-05-16 |
| Vendor | Debian | Last vendor Modification | 2016-05-16 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (CVE-2016-3714), make HTTP GET or FTP requests (CVE-2016-3718), or delete (CVE-2016-3715), move (CVE-2016-3716), or read (CVE-2016-3717) local files. These vulnerabilities are particularly critical if Imagemagick processes images coming from remote parties, such as part of a web service. The update disables the vulnerable coders (EPHEMERAL, URL, MVG, MSL, and PLT) and indirect reads via /etc/ImageMagick-6/policy.xml file. In addition, we introduce extra preventions, including some sanitization for input filenames in http/https delegates, the full remotion of PLT/Gnuplot decoder, and the need of explicit reference in the filename for the insecure coders. For the stable distribution (jessie), these problems have been fixed in version 8:6.8.9.9-5+deb8u2. We recommend that you upgrade your imagemagick packages. |
Original Source
| Url : http://www.debian.org/security/2016/dsa-3580 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 40 % | CWE-20 | Improper Input Validation |
| 20 % | CWE-284 | Access Control (Authorization) Issues |
| 20 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 20 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41902 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41901 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41900 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41899 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41898 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics ephemeral access attempt RuleID : 41897 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41894 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41893 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41892 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41891 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41890 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick magick vector graphics msl access attempt RuleID : 41889 - Revision : 2 - Type : POLICY-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41888 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41887 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41886 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41885 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41884 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-12 | ImageMagick mvg label arbitrary file read attempt RuleID : 41883 - Revision : 1 - Type : SERVER-OTHER |
| 2017-04-06 | ImageMagick mvg processing command server side request forgery attempt RuleID : 41809 - Revision : 2 - Type : FILE-IMAGE |
| 2017-04-06 | ImageMagick mvg processing command server side request forgery attempt RuleID : 41808 - Revision : 2 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39006 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39005 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39004 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39003 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39002 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39001 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-22 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 39000 - Revision : 3 - Type : FILE-IMAGE |
| 2016-06-17 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38948 - Revision : 4 - Type : FILE-IMAGE |
| 2016-06-17 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38947 - Revision : 4 - Type : FILE-IMAGE |
| 2016-06-17 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38946 - Revision : 4 - Type : FILE-IMAGE |
| 2016-06-17 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38945 - Revision : 4 - Type : FILE-IMAGE |
| 2016-06-14 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38871 - Revision : 5 - Type : FILE-IMAGE |
| 2016-06-07 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38744 - Revision : 7 - Type : FILE-IMAGE |
| 2016-06-07 | ImageMagick WWWDecodeDelegate command injection attempt RuleID : 38743 - Revision : 6 - Type : FILE-IMAGE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2018-06-28 | Name : The remote Debian host is missing a security update. File : debian_DLA-1401.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1021.nasl - Type : ACT_GATHER_INFO |
| 2016-12-27 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3746.nasl - Type : ACT_GATHER_INFO |
| 2016-12-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201611-21.nasl - Type : ACT_GATHER_INFO |
| 2016-06-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2990-1.nasl - Type : ACT_GATHER_INFO |
| 2016-05-24 | Name : The remote Debian host is missing a security update. File : debian_DLA-484.nasl - Type : ACT_GATHER_INFO |
| 2016-05-23 | Name : The remote Debian host is missing a security update. File : debian_DLA-486.nasl - Type : ACT_GATHER_INFO |
| 2016-05-20 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-602.nasl - Type : ACT_GATHER_INFO |
| 2016-05-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3580.nasl - Type : ACT_GATHER_INFO |
| 2016-05-16 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL61974123.nasl - Type : ACT_GATHER_INFO |
| 2016-05-16 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL29154575.nasl - Type : ACT_GATHER_INFO |
| 2016-05-16 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL25102203.nasl - Type : ACT_GATHER_INFO |
| 2016-05-16 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL10550253.nasl - Type : ACT_GATHER_INFO |
| 2016-05-13 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1275-1.nasl - Type : ACT_GATHER_INFO |
| 2016-05-12 | Name : The PHP application running on the remote web server is affected by multiple ... File : wordpress_4_5_2.nasl - Type : ACT_GATHER_INFO |
| 2016-05-12 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL03151140.nasl - Type : ACT_GATHER_INFO |
| 2016-05-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-699.nasl - Type : ACT_GATHER_INFO |
| 2016-05-12 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-132-01.nasl - Type : ACT_GATHER_INFO |
| 2016-05-11 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160509_ImageMagick_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2016-05-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-0726.nasl - Type : ACT_GATHER_INFO |
| 2016-05-11 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-0726.nasl - Type : ACT_GATHER_INFO |
| 2016-05-11 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-0726.nasl - Type : ACT_GATHER_INFO |
| 2016-05-09 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1260-1.nasl - Type : ACT_GATHER_INFO |
| 2016-05-09 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-574.nasl - Type : ACT_GATHER_INFO |
| 2016-05-09 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-569.nasl - Type : ACT_GATHER_INFO |
| 2016-05-09 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_0d724b05687f45279c03af34d3b094ec.nasl - Type : ACT_GATHER_INFO |
| 2016-05-04 | Name : The remote Windows host has an application installed that is affected by mult... File : imagemagick_7_0_1_1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-05-18 13:27:58 |
|
| 2016-05-16 21:25:29 |
|
