Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 584512 (CVE-2016-5118) - <media-gfx/graphicsmagick-1.3.24, <media-gfx/imagemagick-6.9.4.6: popen() shell vulnerability via filename (CVE-2016-5118)
Summary: <media-gfx/graphicsmagick-1.3.24, <media-gfx/imagemagick-6.9.4.6: popen() she...
Status: RESOLVED FIXED
Alias: CVE-2016-5118
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor with 1 vote (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-30 08:16 UTC by Agostino Sarubbo
Modified: 2016-07-11 12:50 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-05-30 08:16:00 UTC
From ${URL} :

All existing releases of GraphicsMagick and ImageMagick support a file
open syntax where if the first character of the file specification is
a '|', then the remainder of the filename is passed to the shell for
execution using the POSIX popen(3C) function.  File opening is handled
by an OpenBlob() function in the source file blob.c.  Unlike the
vulnerability described by CVE-2016-3714, this functionality is
supported by the core file opening function rather than a delegates
subsystem usually used to execute external programs.

The funtionality can be demonstrated as follows:

   % rm -f hello.txt
   % convert '|echo Hello > hello.txt;' null:
   % ls hello.txt
   hello.txt

The same weakness in the native SVG readers may be used to provoke
this problem.  This example returns a valid image given a known file 
(but an actual file is not necessary):

   <?xml version="1.0" standalone="no"?>
   <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
   "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
   <svg width="4in" height="3in" version="1.1"
   xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
   <desc>Illustrates how a shell command may be embedded in a SVG.
   </desc>
   <image x="200" y="200" width="100px" height="100px"
   xlink:href="|echo Hello > hello.txt; cat /usr/lib/firefox/browser/icons/mozicon128.png">
   <title>My image</title>
   </image>
   </svg>

Or in MVG:

   push graphic-context
   viewbox 0 0 640 480
   image copy 200,200 100,100 "|echo Hello > hello.txt; cat /usr/lib/firefox/browser/icons/mozicon128.png"
   pop graphic-context

Previously supplied recommended patches for GraphicsMagick do 
successfully block this attack vector in SVG and MVG.

It is highly likely that there are many paths leading to a suitable 
filename which may be executed outside of SVG and MVG since the 
software is quite complex and powerful.  The examples above are not 
meant to suggest that other avenues to the same weakness are not 
available.

The simple solution to the problem is to disable the popen support 
(HAVE_POPEN) in GraphicsMagick's magick/blob.c as is done by the 
attached patch.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Hanno Böck gentoo-dev 2016-05-31 00:03:17 UTC
This affects imagemagick as well. 6.9.4-5 and 7.0.1-7 have been released upstream and contain fixes related to this. Given the severity of these imagemagick issues I think we're handling them too slowly. Please bump asap and start stabilization.
Comment 2 Lars Wendler (Polynomial-C) gentoo-dev 2016-06-02 10:36:16 UTC
commit 68407a602cc64231cd887123da2d33dbe5756230
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Thu Jun 2 08:15:11 2016

    media-gfx/graphicsmagick: Bump to version 1.3.24
    
    Package-Manager: portage-2.2.28
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

commit 33e9a7af50f7b2a5cbb20229deb94d4cb920fe67
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Thu Jun 2 08:04:09 2016

    media-gfx/imagemagick: Bump to versions 6.9.4.6 and 7.0.1.8
    
    Removed old.
    
    Package-Manager: portage-2.2.28
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

@security, please do the stable request for both packages. In case of imagemagick we cannot stabilize version 7 as it still breaks too many packages.
Comment 3 Lars Wendler (Polynomial-C) gentoo-dev 2016-06-02 10:44:34 UTC
Arches please test and mark stable the following two packages.

=media-gfx/imagemagick-6.9.4.6 with target KEYWORDS:

alpha amd64 arm hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~x86-interix ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris


=media-gfx/graphicsmagick-1.3.24 with target KEYWORDS:

alpha amd64 hppa ppc ppc64 sparc x86 ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos
Comment 4 Agostino Sarubbo gentoo-dev 2016-06-02 13:05:53 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2016-06-02 13:06:26 UTC
x86 stable
Comment 6 Jeroen Roovers (RETIRED) gentoo-dev 2016-06-03 04:41:10 UTC
Stable for PPC64.
Comment 7 Tobias Klausmann gentoo-dev 2016-06-06 11:16:21 UTC
Not holding this up because Security, but it newly fails the test suite (6.9.4.1 passes, IIRC). I'll file a separate bug about that.

Both stable on alpha.
Comment 8 Jeroen Roovers (RETIRED) gentoo-dev 2016-06-07 09:18:12 UTC
Stable for HPPA.
Comment 9 Markus Meier gentoo-dev 2016-06-11 13:19:38 UTC
arm stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-07-08 07:58:47 UTC
ppc stable
Comment 11 Agostino Sarubbo gentoo-dev 2016-07-08 10:07:19 UTC
sparc stable
Comment 12 Agostino Sarubbo gentoo-dev 2016-07-08 12:06:31 UTC
ia64 stable.

Maintainer(s), please cleanup.
Comment 13 Markus Meier gentoo-dev 2016-07-10 09:01:15 UTC
(In reply to Agostino Sarubbo from comment #12)
> ia64 stable.
> 
> Maintainer(s), please cleanup.

done.
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2016-07-11 04:28:38 UTC
CVE-2016-5118 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5118):
  The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and
  ImageMagick allows remote attackers to execute arbitrary code via a | (pipe)
  character at the start of a filename.
Comment 15 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-07-11 04:29:22 UTC
GLSA Vote: No
Comment 16 Patrice Clement gentoo-dev 2016-07-11 12:50:27 UTC
commit 1a4c6b2bea42b8631c56c861c37f88930da4f007 (HEAD -> master)
Author:     Patrice Clement <monsieurp@gentoo.org>
AuthorDate: Mon Jul 11 12:07:34 2016 +0000
Commit:     Patrice Clement <monsieurp@gentoo.org>
CommitDate: Mon Jul 11 12:20:50 2016 +0000

dev-python/pythonmagick: Remove v0.9.11 relying on unsecure and outdated releases of ImageMagick.

Gentoo-Bug: https://bugs.gentoo.org/584512

Package-Manager: portage-2.2.28

dev-python/pythonmagick/Manifest                   |  1 -
dev-python/pythonmagick/pythonmagick-0.9.11.ebuild | 61 ----------------------
2 files changed, 62 deletions(-)
delete mode 100644 dev-python/pythonmagick/pythonmagick-0.9.11.ebuild