oss-sec mailing list archives
ImageMagick identify "d:" hangs
From: Bob Friesenhahn <bfriesen () simple dallas tx us>
Date: Tue, 27 Sep 2016 08:48:42 -0500 (CDT)
Today I noticed ImageMagick issue #275 (https://github.com/ImageMagick/ImageMagick/issues/275) which was posted 4 days ago. I was able to reproduce this issue with the ImageMagick provided by my Ubuntu system (6.8.9-9).
The problem is that a file name ending with a colon (':') causes the program to hang forever. If an attacker is able to have some control over the input file name, then this could be used to cause DOS by hanging the program.
The following is the text from the problem report: qwerty4030 commented 4 days ago • edited Version: ImageMagick 6.9.3-10 Q16 x86_64 2016-05-04 http://www.imagemagick.org Copyright: Copyright (C) 1999-2016 ImageMagick Studio LLC License: http://www.imagemagick.org/script/license.php Features: Cipher DPC OpenMP Delegates (built-in): jng jpeg lzma png tiff xml zlib OS: 4.4.10-22.54.amzn1.x86_64 (amazon linux) identify hangs on the following commands: identify "d:" (no output, just hangs forever) identify "d::" (no output, just hangs forever) identify "http:" error : Unknown IO error (hangs after this message) identify "http::" error : Unknown IO error (hangs after this message)
From my own investigations, I used
identify -debug all "d:"and see that a temporary file is reported to be created and then the program hangs which no apparent CPU usage.
Bob -- Bob Friesenhahn bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Current thread:
- ImageMagick identify "d:" hangs Bob Friesenhahn (Sep 27)
- Re: ImageMagick identify "d:" hangs Jakub Wilk (Sep 27)
- Re: ImageMagick identify "d:" hangs Bob Friesenhahn (Sep 27)
- Re: ImageMagick identify "d:" hangs Tavis Ormandy (Sep 28)
- Re: ImageMagick identify "d:" hangs Tavis Ormandy (Sep 28)
- Re: ImageMagick identify "d:" hangs Tavis Ormandy (Sep 28)
- Re: ImageMagick identify "d:" hangs Bob Friesenhahn (Sep 28)
- Re: ImageMagick identify "d:" hangs Tavis Ormandy (Sep 28)
- Re: ImageMagick identify "d:" hangs Florian Weimer (Sep 28)
- Re: ImageMagick identify "d:" hangs Bob Friesenhahn (Sep 27)
- Re: ImageMagick identify "d:" hangs Jakub Wilk (Sep 27)
- Re: ImageMagick identify "d:" hangs Florian Weimer (Sep 28)
- Re: ImageMagick identify "d:" hangs Tavis Ormandy (Sep 29)