Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 May 2016 12:42:24 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714

On Thu, 19 May 2016, Jeremy Stanley wrote:
>> As an example Ubuntu 14.04.4 LTS (which is supposed to be getting
>> security updates) has not provided ImageMagick or GraphicsMagick
>> package updates in 3 years.
> [...]
>
> Seems to be in progress? https://launchpad.net/bugs/1578398

That is good to hear.

OS distribution response seems to be good for software like ISC named 
and OpenSSH but seems to be very poor for this trivial shell-exploit 
issue which impacts a great many (perhaps more than a million) Linux, 
*BSD, Solaris, and OS-X users.  Perhaps this is because the developers 
of such packages are used to providing advance notice and a 
well-formed response and distribution maintainers are practiced and 
ready.

Most people using a graphical desktop (e.g Gnome and KDE) are exposed 
to the issue since ImageMagick (and often GraphicsMagick) is a common 
dependency and clicking on a file in a graphical file manager (or 
delivered as an email attachment) is likely to expose the user to the 
problem.  Servers processing uploaded images are exposed to the issue 
but server applications often take additional precautions which might 
protect from the problem.  Desktop users are entirely exposed.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ