Re: CVE request for imagemagick bug

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/29/2013 05:24 PM, Bastien ROUCARIES wrote:
> The gif handling code of imagemagick allow execution of arbitrary
> code due to a buffer overflow of one byte. Gif image format is made
> of different kind of data unit called block and these block may
> appear at anytime. The code actually do the equivalent of
> a=malloc(length+count) [line 1 of the patch] and
> a[length+count]='\0' for each comment block [line 11 of patch]. 
> Because this code is executed for every comment block and that an 
> attacker could put arbitrary block between each comment block, and 
> finaly this attacker could smash memory particularly on
> architecture where malloc layout is predictable. Worst the bug
> could be exploited remotly throught php-magick or perlmagick. A
> special image leading to malloc space corruption and thus a dos is
> available.
>
> Imagemagick before version 6.7.8-8 are affected.
>
> See upstream bug report here: 
> http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=23921
>
>  First reported as a dos here: 
> https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1218248
>
> Fixed by commit: 
> http://trac.imagemagick.org/changeset/8770/ImageMagick/trunk/coders/gif.c
>
>  Analysis by myself

Please use CVE-2013-4298  for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBAgAGBQJSJjp5AAoJEBYNRVNeJnmTW8IP/19g8bncqMvQq1HH8yd9/WGP
vZnrAlZOS8lPT/MeUQVVgOz9ft6Lyl1JDMIuFhL4zN0/pDDIvIO16ztd6kt71zHP
OMRt7Zi544d7galikjelje7RTEYJoWFUhRoBaAT6NDmEY61s6QtxKD1jUIZYlOU1
kXANs3THmQSrYI/sV9v+uZ4GH9jq/2g9iSSnO0H/sWoSe0m9YvI6k1q/Y2bRoUN1
laTqd2HSAYk4yy/q2PnlC4Coxh1PfadSYD+eMmJvXV5XVZMd/QhQxfGPYW35/YjZ
L/yXB4ur93cNax6E6Jc9dx5SM6l74I9SXsOGhvRA8r51p2jkOEdnyubNljmEpP09
tbDdzosJ2uslK3gN38fiaiwLITpT5DA+weTQ01J1CJBNbBeg3ZXBChukbUlhfdnM
K9jEoTj44GeJb5SWhG0lL26XWucExzdfVB+5SuX5Wle89BYQagzgyL6x1IoIugrO
vrOkSGEtwgQCvQlQByLGh5Qe+2h9hcbLd1sEv9gCHvhYeP7jEt5pAG7EP/UGPvBT
u0MQCND3ZSbtVkVFDo2LzgwkP2xZMJ/RRTdhyTnmnUp+Mp1A2k7AxysPr6VxDsr+
AT3kNuqpTUt8irkFZiTlcU767Y/SNM/nEaARbbyCs4zvu/nqSfEym91/RiwaEULN
sO4B9uKmJU3exYitJCCa
=JzSv
-----END PGP SIGNATURE-----