Vulnerabilities > CVE-2012-0259 - Out-Of-Bounds Read vulnerability in Imagemagick

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL

Summary

The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read.

Vulnerable Configurations

Part Description Count
Application
Imagemagick
628
OS
Debian
1
OS
Canonical
4
OS
Opensuse
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-0544.NASL
    descriptionUpdated ImageMagick packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. (CVE-2012-0247) A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. (CVE-2012-0248) It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. (CVE-2010-4167) An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. (CVE-2012-0259) A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. (CVE-2012-0260) An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. (CVE-2012-1798) Red Hat would like to thank CERT-FI for reporting CVE-2012-0259, CVE-2012-0260, and CVE-2012-1798. CERT-FI acknowledges Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of Codenomicon
    last seen2020-06-01
    modified2020-06-02
    plugin id59019
    published2012-05-08
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59019
    titleCentOS 6 : ImageMagick (CESA-2012:0544)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:0544 and 
    # CentOS Errata and Security Advisory 2012:0544 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59019);
      script_version("1.11");
      script_cvs_date("Date: 2020/01/07");
    
      script_cve_id("CVE-2010-4167", "CVE-2012-0247", "CVE-2012-0248", "CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1798");
      script_bugtraq_id(45044, 51957, 52898);
      script_xref(name:"RHSA", value:"2012:0544");
    
      script_name(english:"CentOS 6 : ImageMagick (CESA-2012:0544)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated ImageMagick packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    ImageMagick is an image display and manipulation tool for the X Window
    System that can read and write multiple image formats.
    
    A flaw was found in the way ImageMagick processed images with
    malformed Exchangeable image file format (Exif) metadata. An attacker
    could create a specially crafted image file that, when opened by a
    victim, would cause ImageMagick to crash or, potentially, execute
    arbitrary code. (CVE-2012-0247)
    
    A denial of service flaw was found in the way ImageMagick processed
    images with malformed Exif metadata. An attacker could create a
    specially crafted image file that, when opened by a victim, could
    cause ImageMagick to enter an infinite loop. (CVE-2012-0248)
    
    It was found that ImageMagick utilities tried to load ImageMagick
    configuration files from the current working directory. If a user ran
    an ImageMagick utility in an attacker-controlled directory containing
    a specially crafted ImageMagick configuration file, it could cause the
    utility to execute arbitrary code. (CVE-2010-4167)
    
    An integer overflow flaw was found in the way ImageMagick processed
    certain Exif tags with a large components count. An attacker could
    create a specially crafted image file that, when opened by a victim,
    could cause ImageMagick to access invalid memory and crash.
    (CVE-2012-0259)
    
    A denial of service flaw was found in the way ImageMagick decoded
    certain JPEG images. A remote attacker could provide a JPEG image with
    specially crafted sequences of RST0 up to RST7 restart markers (used
    to indicate the input stream to be corrupted), which once processed by
    ImageMagick, would cause it to consume excessive amounts of memory and
    CPU time. (CVE-2012-0260)
    
    An out-of-bounds buffer read flaw was found in the way ImageMagick
    processed certain TIFF image files. A remote attacker could provide a
    TIFF image with a specially crafted Exif IFD value (the set of tags
    for recording Exif-specific attribute information), which once opened
    by ImageMagick, would cause it to crash. (CVE-2012-1798)
    
    Red Hat would like to thank CERT-FI for reporting CVE-2012-0259,
    CVE-2012-0260, and CVE-2012-1798. CERT-FI acknowledges Aleksis
    Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of
    Codenomicon's CROSS project as the original reporters.
    
    Users of ImageMagick are advised to upgrade to these updated packages,
    which contain backported patches to correct these issues. All running
    instances of ImageMagick must be restarted for this update to take
    effect."
      );
      # https://lists.centos.org/pipermail/centos-announce/2012-May/018615.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?18e8f45d"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected imagemagick packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-0247");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick-c++");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick-c++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ImageMagick-perl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/11/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 6.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-6.5.4.7-6.el6_2")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-c++-6.5.4.7-6.el6_2")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-c++-devel-6.5.4.7-6.el6_2")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-devel-6.5.4.7-6.el6_2")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-doc-6.5.4.7-6.el6_2")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"ImageMagick-perl-6.5.4.7-6.el6_2")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc");
    }
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_IMAGEMAGICK_20130924.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read. (CVE-2012-0259) - The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers. (CVE-2012-0260) - Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259. (CVE-2012-1610) - The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image. (CVE-2012-1798)
    last seen2020-06-01
    modified2020-06-02
    plugin id80643
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80643
    titleOracle Solaris Third-Party Patch Update : imagemagick (multiple_vulnerabilities_in_imagemagick2)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from the Oracle Third Party software advisories.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(80643);
      script_version("1.2");
      script_cvs_date("Date: 2018/11/15 20:50:24");
    
      script_cve_id("CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1610", "CVE-2012-1798");
    
      script_name(english:"Oracle Solaris Third-Party Patch Update : imagemagick (multiple_vulnerabilities_in_imagemagick2)");
      script_summary(english:"Check for the 'entire' version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Solaris system is missing a security patch for third-party
    software."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote Solaris system is missing necessary patches to address
    security updates :
    
      - The GetEXIFProperty function in magick/property.c in
        ImageMagick before 6.7.6-3 allows remote attackers to
        cause a denial of service (crash) via a zero value in
        the component count of an EXIF XResolution tag in a JPEG
        file, which triggers an out-of-bounds read.
        (CVE-2012-0259)
    
      - The JPEGWarningHandler function in coders/jpeg.c in
        ImageMagick before 6.7.6-3 allows remote attackers to
        cause a denial of service (memory consumption) via a
        JPEG image with a crafted sequence of restart markers.
        (CVE-2012-0260)
    
      - Integer overflow in the GetEXIFProperty function in
        magick/property.c in ImageMagick before 6.7.6-4 allows
        remote attackers to cause a denial of service
        (out-of-bounds read) via a large component count for
        certain EXIF tags in a JPEG image. NOTE: this
        vulnerability exists because of an incomplete fix for
        CVE-2012-0259. (CVE-2012-1610)
    
      - The TIFFGetEXIFProperties function in coders/tiff.c in
        ImageMagick before 6.7.6-3 allows remote attackers to
        cause a denial of service (out-of-bounds read and crash)
        via a crafted EXIF IFD in a TIFF image. (CVE-2012-1798)"
      );
      # https://www.oracle.com/technetwork/topics/security/thirdparty-patch-map-1482893.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4a913f44"
      );
      # https://blogs.oracle.com/sunsecurity/multiple-vulnerabilities-in-imagemagick
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?e61e638e"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade to Solaris 11.1.11.4.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:11.1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:imagemagick");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2013/09/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/01/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris11/release", "Host/Solaris11/pkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Solaris11/release");
    if (isnull(release)) audit(AUDIT_OS_NOT, "Solaris11");
    pkg_list = solaris_pkg_list_leaves();
    if (isnull (pkg_list)) audit(AUDIT_PACKAGE_LIST_MISSING, "Solaris pkg-list packages");
    
    if (empty_or_null(egrep(string:pkg_list, pattern:"^imagemagick$"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "imagemagick");
    
    flag = 0;
    
    if (solaris_check_release(release:"0.5.11-0.175.1.11.0.4.0", sru:"SRU 11.1.11.4.0") > 0) flag++;
    
    if (flag)
    {
      error_extra = 'Affected package : imagemagick\n' + solaris_get_report2();
      error_extra = ereg_replace(pattern:"version", replace:"OS version", string:error_extra);
      if (report_verbosity > 0) security_warning(port:0, extra:error_extra);
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_PACKAGE_NOT_AFFECTED, "imagemagick");
    
  • NASL familyWindows
    NASL idIMAGEMAGICK_6_7_6_3.NASL
    descriptionThe remote Windows host is running a version of ImageMagick earlier than 6.7.6-3 and is, therefore, affected by the following vulnerabilities : - An error exists in the function
    last seen2020-06-01
    modified2020-06-02
    plugin id59370
    published2012-06-05
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59370
    titleImageMagick < 6.7.6-3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59370);
      script_version("1.8");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id("CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1798");
      script_bugtraq_id(52898);
    
      script_name(english:"ImageMagick < 6.7.6-3 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of ImageMagick");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains an application that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is running a version of ImageMagick earlier
    than 6.7.6-3 and is, therefore, affected by the following
    vulnerabilities :
    
      - An error exists in the function 'GetEXIFProperty' in
        the file 'magick/property.c' that can cause the
        application to crash when processing JPEG 'EXIF' data.
        (CVE-2012-0259)
    
      - An error exists in the function 'JPEGWarningHandler' in
        the file 'coders/jpeg.c' that can cause the application
        to consume large amounts of resources when handling JPEG
        'restart' markers. (CVE-2012-0260)
    
      - An error exists in the function 'TIFFGetEXIFProperties'
        in the file 'coders/tiff.c' that can cause the
        application crash when processing TIFF 'EXIF' 'IFD'
        data. (CVE-2012-1798)");
      script_set_attribute(attribute:"see_also", value:"http://www.cert.fi/en/reports/2012/vulnerability635606.html");
      # http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629#p82689
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e13122e9");
      script_set_attribute(attribute:"see_also", value:"http://www.imagemagick.org/script/changelog.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to ImageMagick version 6.7.6-3 or later.
    
    Note that you may need to manually uninstall the vulnerable version
    from the system.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-0260");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/03/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/03/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/05");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:imagemagick:imagemagick");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("imagemagick_installed.nasl");
      script_require_keys("installed_sw/ImageMagick");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    app = "ImageMagick";
    fix = "6.7.6";
    fix_build = 3;
    
    # Get installs
    install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
    display_version = install['display_version'];
    version         = install['version'];
    build           = install['build'];
    path            = install['path'];
    
    vuln = FALSE;
    
    display_fix = fix + "-" + fix_build;
    
    if (ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
      vuln = TRUE;
    
    if ((ver_compare(ver:version, fix:fix, strict:FALSE) == 0)  &&
        build < fix_build
       )
      vuln = TRUE;
    
    if (vuln)
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      items = make_array("Installed version", display_version,
                         "Fixed version", display_fix,
                         "Path", path
                        );
    
      order = make_list("Path", "Installed version", "Fixed version");
      report = report_items_str(report_items:items, ordered_fields:order);
    
      security_report_v4(port:port, extra:report, severity:SECURITY_WARNING);
      exit(0);
    }
    else
      audit(AUDIT_INST_PATH_NOT_VULN, app, display_version, path);
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-078.NASL
    descriptionMultiple vulnerabilities has been found and corrected in imagemagick : A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code (CVE-2012-0247). A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop (CVE-2012-0248). The original fix for CVE-2012-0247 failed to check for the possibility of an integer overflow when computing the sum of number_bytes and offset. This resulted in a wrap around into a value smaller than length, making original CVE-2012-0247 introduced length check still to be possible to bypass, leading to memory corruption (CVE-2012-1185). An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash (CVE-2012-0259). A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time (CVE-2012-0260). An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash (CVE-2012-1798). The updated packages have been patched to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id61952
    published2012-09-06
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61952
    titleMandriva Linux Security Advisory : imagemagick (MDVSA-2012:078)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2012:078. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61952);
      script_version("1.10");
      script_cvs_date("Date: 2019/08/02 13:32:54");
    
      script_cve_id(
        "CVE-2012-0247",
        "CVE-2012-0248",
        "CVE-2012-0259",
        "CVE-2012-0260",
        "CVE-2012-1185",
        "CVE-2012-1798"
      );
      script_bugtraq_id(
        51957,
        52898
      );
      script_xref(name:"MDVSA", value:"2012:078");
    
      script_name(english:"Mandriva Linux Security Advisory : imagemagick (MDVSA-2012:078)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities has been found and corrected in imagemagick :
    
    A flaw was found in the way ImageMagick processed images with
    malformed Exchangeable image file format (Exif) metadata. An attacker
    could create a specially crafted image file that, when opened by a
    victim, would cause ImageMagick to crash or, potentially, execute
    arbitrary code (CVE-2012-0247).
    
    A denial of service flaw was found in the way ImageMagick processed
    images with malformed Exif metadata. An attacker could create a
    specially crafted image file that, when opened by a victim, could
    cause ImageMagick to enter an infinite loop (CVE-2012-0248).
    
    The original fix for CVE-2012-0247 failed to check for the possibility
    of an integer overflow when computing the sum of number_bytes and
    offset. This resulted in a wrap around into a value smaller than
    length, making original CVE-2012-0247 introduced length check still to
    be possible to bypass, leading to memory corruption (CVE-2012-1185).
    
    An integer overflow flaw was found in the way ImageMagick processed
    certain Exif tags with a large components count. An attacker could
    create a specially crafted image file that, when opened by a victim,
    could cause ImageMagick to access invalid memory and crash
    (CVE-2012-0259).
    
    A denial of service flaw was found in the way ImageMagick decoded
    certain JPEG images. A remote attacker could provide a JPEG image with
    specially crafted sequences of RST0 up to RST7 restart markers (used
    to indicate the input stream to be corrupted), which once processed by
    ImageMagick, would cause it to consume excessive amounts of memory and
    CPU time (CVE-2012-0260).
    
    An out-of-bounds buffer read flaw was found in the way ImageMagick
    processed certain TIFF image files. A remote attacker could provide a
    TIFF image with a specially crafted Exif IFD value (the set of tags
    for recording Exif-specific attribute information), which once opened
    by ImageMagick, would cause it to crash (CVE-2012-1798).
    
    The updated packages have been patched to correct these issues."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-desktop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:imagemagick-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64magick4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libmagick4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:perl-Image-Magick");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2011");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK2011", reference:"imagemagick-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"imagemagick-desktop-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"imagemagick-doc-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64magick-devel-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64magick4-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libmagick-devel-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libmagick4-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"perl-Image-Magick-6.7.0.9-1.1-mdv2011.0", yank:"mdv")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-310.NASL
    descriptionSpecially crafted files could cause overflows in ImageMagick
    last seen2020-06-05
    modified2014-06-13
    plugin id74644
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74644
    titleopenSUSE Security Update : ImageMagick (openSUSE-SU-2012:0692-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-310.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74644);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-0247", "CVE-2012-0248", "CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1185", "CVE-2012-1186", "CVE-2012-1610", "CVE-2012-1798");
    
      script_name(english:"openSUSE Security Update : ImageMagick (openSUSE-SU-2012:0692-1)");
      script_summary(english:"Check for the openSUSE-2012-310 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:"Specially crafted files could cause overflows in ImageMagick"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=746880"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=752879"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=754749"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=758512"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected ImageMagick packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-extra");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ImageMagick-extra-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagick++5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickCore5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libMagickWand5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-PerlMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-PerlMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/06/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-debugsource-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-devel-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-extra-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"ImageMagick-extra-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagick++-devel-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagick++5-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagick++5-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagickCore5-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagickCore5-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagickWand5-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libMagickWand5-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"perl-PerlMagick-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"perl-PerlMagick-debuginfo-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"ImageMagick-devel-32bit-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickCore5-32bit-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickCore5-debuginfo-32bit-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickWand5-32bit-6.7.2.7-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libMagickWand5-debuginfo-32bit-6.7.2.7-5.5.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick / ImageMagick-debuginfo / ImageMagick-debugsource / etc");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5140DC69B65E11E19425001B21614864.NASL
    descriptionImageMagick reports : Three vulnerabilities have been identified in ImageMagick
    last seen2020-06-01
    modified2020-06-02
    plugin id59517
    published2012-06-15
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59517
    titleFreeBSD : ImageMagick -- multiple vulnerabilities (5140dc69-b65e-11e1-9425-001b21614864)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59517);
      script_version("1.5");
      script_cvs_date("Date: 2018/12/19 13:21:18");
    
      script_cve_id("CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1798");
    
      script_name(english:"FreeBSD : ImageMagick -- multiple vulnerabilities (5140dc69-b65e-11e1-9425-001b21614864)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "ImageMagick reports :
    
    Three vulnerabilities have been identified in ImageMagick's handling
    of JPEG and TIFF files. With these vulnerabilities, it is possible to
    cause a denial of service situation in the target system."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629"
      );
      # http://www.cert.fi/en/reports/2012/vulnerability635606.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a5579ed2"
      );
      # https://vuxml.freebsd.org/freebsd/5140dc69-b65e-11e1-9425-001b21614864.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?f0502a89"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:ImageMagick-nox11");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/03/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick<6.7.6.4")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"ImageMagick-nox11<6.7.6.4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-0544.NASL
    descriptionUpdated ImageMagick packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. (CVE-2012-0247) A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. (CVE-2012-0248) It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. (CVE-2010-4167) An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. (CVE-2012-0259) A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. (CVE-2012-0260) An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. (CVE-2012-1798) Red Hat would like to thank CERT-FI for reporting CVE-2012-0259, CVE-2012-0260, and CVE-2012-1798. CERT-FI acknowledges Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of Codenomicon
    last seen2020-06-01
    modified2020-06-02
    plugin id59028
    published2012-05-08
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59028
    titleRHEL 6 : ImageMagick (RHSA-2012:0544)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:0544. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59028);
      script_version ("1.18");
      script_cvs_date("Date: 2019/10/24 15:35:35");
    
      script_cve_id("CVE-2010-4167", "CVE-2012-0247", "CVE-2012-0248", "CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1798");
      script_bugtraq_id(45044, 51957, 52898);
      script_xref(name:"RHSA", value:"2012:0544");
    
      script_name(english:"RHEL 6 : ImageMagick (RHSA-2012:0544)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated ImageMagick packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    ImageMagick is an image display and manipulation tool for the X Window
    System that can read and write multiple image formats.
    
    A flaw was found in the way ImageMagick processed images with
    malformed Exchangeable image file format (Exif) metadata. An attacker
    could create a specially crafted image file that, when opened by a
    victim, would cause ImageMagick to crash or, potentially, execute
    arbitrary code. (CVE-2012-0247)
    
    A denial of service flaw was found in the way ImageMagick processed
    images with malformed Exif metadata. An attacker could create a
    specially crafted image file that, when opened by a victim, could
    cause ImageMagick to enter an infinite loop. (CVE-2012-0248)
    
    It was found that ImageMagick utilities tried to load ImageMagick
    configuration files from the current working directory. If a user ran
    an ImageMagick utility in an attacker-controlled directory containing
    a specially crafted ImageMagick configuration file, it could cause the
    utility to execute arbitrary code. (CVE-2010-4167)
    
    An integer overflow flaw was found in the way ImageMagick processed
    certain Exif tags with a large components count. An attacker could
    create a specially crafted image file that, when opened by a victim,
    could cause ImageMagick to access invalid memory and crash.
    (CVE-2012-0259)
    
    A denial of service flaw was found in the way ImageMagick decoded
    certain JPEG images. A remote attacker could provide a JPEG image with
    specially crafted sequences of RST0 up to RST7 restart markers (used
    to indicate the input stream to be corrupted), which once processed by
    ImageMagick, would cause it to consume excessive amounts of memory and
    CPU time. (CVE-2012-0260)
    
    An out-of-bounds buffer read flaw was found in the way ImageMagick
    processed certain TIFF image files. A remote attacker could provide a
    TIFF image with a specially crafted Exif IFD value (the set of tags
    for recording Exif-specific attribute information), which once opened
    by ImageMagick, would cause it to crash. (CVE-2012-1798)
    
    Red Hat would like to thank CERT-FI for reporting CVE-2012-0259,
    CVE-2012-0260, and CVE-2012-1798. CERT-FI acknowledges Aleksis
    Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of
    Codenomicon's CROSS project as the original reporters.
    
    Users of ImageMagick are advised to upgrade to these updated packages,
    which contain backported patches to correct these issues. All running
    instances of ImageMagick must be restarted for this update to take
    effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2012:0544"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2010-4167"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0247"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0248"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0260"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0259"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1798"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-c++");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-c++-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ImageMagick-perl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/11/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2012:0544";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", reference:"ImageMagick-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"ImageMagick-c++-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"ImageMagick-c++-devel-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"ImageMagick-debuginfo-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"ImageMagick-devel-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"ImageMagick-doc-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"ImageMagick-doc-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"ImageMagick-doc-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"ImageMagick-perl-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"ImageMagick-perl-6.5.4.7-6.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"ImageMagick-perl-6.5.4.7-6.el6_2")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc");
      }
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2462.NASL
    descriptionSeveral integer overflows and missing input validations were discovered in the ImageMagick image manipulation suite, resulting in the execution of arbitrary code or denial of service.
    last seen2020-03-17
    modified2012-04-30
    plugin id58908
    published2012-04-30
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58908
    titleDebian DSA-2462-2 : imagemagick - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2462. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(58908);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-0259", "CVE-2012-0260", "CVE-2012-1185", "CVE-2012-1186", "CVE-2012-1610", "CVE-2012-1798");
      script_bugtraq_id(51957, 52898);
      script_xref(name:"DSA", value:"2462");
    
      script_name(english:"Debian DSA-2462-2 : imagemagick - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several integer overflows and missing input validations were
    discovered in the ImageMagick image manipulation suite, resulting in
    the execution of arbitrary code or denial of service."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze/imagemagick"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2012/dsa-2462"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the imagemagick packages.
    
    For the stable distribution (squeeze), this problem has been fixed in
    version 6.6.0.4-3+squeeze3."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:imagemagick");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/30");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"imagemagick", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"imagemagick-dbg", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"imagemagick-doc", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagick++-dev", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagick++3", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagickcore-dev", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagickcore3", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagickcore3-extra", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagickwand-dev", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"libmagickwand3", reference:"6.6.0.4-3+squeeze3")) flag++;
    if (deb_check(release:"6.0", prefix:"perlmagick", reference:"6.6.0.4-3+squeeze3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_IMAGEMAGICK-8104.NASL
    descriptionThis update of ImageMagick fixes multiple security vulnerabilities that could have been exploited by attackers via specially crafted image files : - Integer overflow when processing EXIF directory entries with tags of e.g. format 5 (EXIF_FMT_URATIONAL) and a large components count. (CVE-2012-0259 / CVE-2012-1610) - Integer overflows via
    last seen2020-06-05
    modified2012-06-20
    plugin id59602
    published2012-06-20
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59602
    titleSuSE 10 Security Update : ImageMagick (ZYPP Patch Number 8104)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1435-1.NASL
    descriptionJoonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain ResolutionUnit tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2012-0247, CVE-2012-1185) Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain IFD structures. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2012-0248, CVE-2012-1186) Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that ImageMagick incorrectly handled certain JPEG EXIF tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. (CVE-2012-0259) It was discovered that ImageMagick incorrectly handled certain JPEG EXIF tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2012-1610) Aleksis Kauppinen, Joonas Kuorilehto and Tuomas Parttimaa discovered that ImageMagick incorrectly handled certain TIFF EXIF tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. (CVE-2012-1798). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id58964
    published2012-05-02
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/58964
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : imagemagick vulnerabilities (USN-1435-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_IMAGEMAGICK-120427.NASL
    descriptionThis update of ImageMagick fixes multiple security vulnerabilities that could be exploited by attackers via specially crafted image files : - Integer overflow when processing EXIF directory entries with tags of e.g. format 5 (EXIF_FMT_URATIONAL) and a large components count. (CVE-2012-0259 / CVE-2012-1610) - Integer overflows via
    last seen2020-06-05
    modified2013-01-25
    plugin id64158
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64158
    titleSuSE 11.1 Security Update : ImageMagick (SAT Patch Number 6226)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120507_IMAGEMAGICK_ON_SL6_X.NASL
    descriptionImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. (CVE-2012-0247) A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. (CVE-2012-0248) It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. (CVE-2010-4167) An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. (CVE-2012-0259) A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. (CVE-2012-0260) An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. (CVE-2012-1798) Users of ImageMagick are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of ImageMagick must be restarted for this update to take effect.
    last seen2020-03-18
    modified2012-08-01
    plugin id61310
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61310
    titleScientific Linux Security Update : ImageMagick on SL6.x i386/x86_64 (20120507)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2012-76.NASL
    descriptionA flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. (CVE-2012-0247) A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. (CVE-2012-0248) It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. (CVE-2010-4167) An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. (CVE-2012-0259) A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. (CVE-2012-0260) An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. (CVE-2012-1798)
    last seen2020-06-01
    modified2020-06-02
    plugin id69683
    published2013-09-04
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69683
    titleAmazon Linux AMI : ImageMagick (ALAS-2012-76)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-9313.NASL
    descriptionAddress several CVE issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-06-25
    plugin id59662
    published2012-06-25
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59662
    titleFedora 16 : ImageMagick-6.7.0.10-5.fc16 (2012-9313)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-077.NASL
    descriptionMultiple vulnerabilities has been found and corrected in imagemagick : Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory (CVE-2010-4167). A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code (CVE-2012-0247). A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop (CVE-2012-0248). The original fix for CVE-2012-0247 failed to check for the possibility of an integer overflow when computing the sum of number_bytes and offset. This resulted in a wrap around into a value smaller than length, making original CVE-2012-0247 introduced length check still to be possible to bypass, leading to memory corruption (CVE-2012-1185). An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash (CVE-2012-0259). A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time (CVE-2012-0260). An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash (CVE-2012-1798). The updated packages have been patched to correct these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id59185
    published2012-05-18
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59185
    titleMandriva Linux Security Advisory : imagemagick (MDVSA-2012:077)
  • NASL familyWindows
    NASL idIMAGEMAGICK_6_7_6_4.NASL
    descriptionThe remote Windows host is running a version of ImageMagick earlier than 6.7.6-4 and is, therefore, affected by a heap-based buffer overflow vulnerability because the fix for CVE-2012-0259 was incomplete. The functions
    last seen2020-06-01
    modified2020-06-02
    plugin id59371
    published2012-06-05
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59371
    titleImageMagick < 6.7.6-4 profile.c Heap-Based Buffer Overflow
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-0544.NASL
    descriptionFrom Red Hat Security Advisory 2012:0544 : Updated ImageMagick packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. A flaw was found in the way ImageMagick processed images with malformed Exchangeable image file format (Exif) metadata. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary code. (CVE-2012-0247) A denial of service flaw was found in the way ImageMagick processed images with malformed Exif metadata. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to enter an infinite loop. (CVE-2012-0248) It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an attacker-controlled directory containing a specially crafted ImageMagick configuration file, it could cause the utility to execute arbitrary code. (CVE-2010-4167) An integer overflow flaw was found in the way ImageMagick processed certain Exif tags with a large components count. An attacker could create a specially crafted image file that, when opened by a victim, could cause ImageMagick to access invalid memory and crash. (CVE-2012-0259) A denial of service flaw was found in the way ImageMagick decoded certain JPEG images. A remote attacker could provide a JPEG image with specially crafted sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by ImageMagick, would cause it to consume excessive amounts of memory and CPU time. (CVE-2012-0260) An out-of-bounds buffer read flaw was found in the way ImageMagick processed certain TIFF image files. A remote attacker could provide a TIFF image with a specially crafted Exif IFD value (the set of tags for recording Exif-specific attribute information), which once opened by ImageMagick, would cause it to crash. (CVE-2012-1798) Red Hat would like to thank CERT-FI for reporting CVE-2012-0259, CVE-2012-0260, and CVE-2012-1798. CERT-FI acknowledges Aleksis Kauppinen, Joonas Kuorilehto, Tuomas Parttimaa and Lasse Ylivainio of Codenomicon
    last seen2020-06-01
    modified2020-06-02
    plugin id68522
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68522
    titleOracle Linux 6 : ImageMagick (ELSA-2012-0544)

Redhat

advisories
rhsa
idRHSA-2012:0544
rpms
  • ImageMagick-0:6.5.4.7-6.el6_2
  • ImageMagick-c++-0:6.5.4.7-6.el6_2
  • ImageMagick-c++-devel-0:6.5.4.7-6.el6_2
  • ImageMagick-debuginfo-0:6.5.4.7-6.el6_2
  • ImageMagick-doc-0:6.5.4.7-6.el6_2
  • ImageMagick-perl-0:6.5.4.7-6.el6_2

Seebug

bulletinFamilyexploit
descriptionBugtraq ID: 52898 CVE ID:CVE-2012-0259 ImageMagick是一个图象处理软件 当解析组件计数(components count)为0的JPEG EXIF标签时&quot;GetEXIFProperty()&quot;函数(magick/property.c)存在错误,可被利用构建恶意JPEG图像,访问未初始化或非法内存,使应用程序崩溃 0 ImageMagick 6.7.6-2 厂商解决方案 ImageMagick 6.7.6-4已经修复此漏洞,建议用户下载使用: http://www.imagemagick.org/
idSSV:60026
last seen2017-11-19
modified2012-04-07
published2012-04-07
reporterRoot
titleImageMagick 拒绝服务漏洞(CVE-2012-0259)