Date: Tue, 27 Sep 2016 08:48:42 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: ImageMagick identify "d:" hangs Today I noticed ImageMagick issue #275 (https://github.com/ImageMagick/ImageMagick/issues/275) which was posted 4 days ago. I was able to reproduce this issue with the ImageMagick provided by my Ubuntu system (6.8.9-9). The problem is that a file name ending with a colon (':') causes the program to hang forever. If an attacker is able to have some control over the input file name, then this could be used to cause DOS by hanging the program. The following is the text from the problem report: qwerty4030 commented 4 days ago • edited Version: ImageMagick 6.9.3-10 Q16 x86_64 2016-05-04 http://www.imagemagick.org Copyright: Copyright (C) 1999-2016 ImageMagick Studio LLC License: http://www.imagemagick.org/script/license.php Features: Cipher DPC OpenMP Delegates (built-in): jng jpeg lzma png tiff xml zlib OS: 4.4.10-22.54.amzn1.x86_64 (amazon linux) identify hangs on the following commands: identify "d:" (no output, just hangs forever) identify "d::" (no output, just hangs forever) identify "http:" error : Unknown IO error (hangs after this message) identify "http::" error : Unknown IO error (hangs after this message) >From my own investigations, I used identify -debug all "d:" and see that a temporary file is reported to be created and then the program hangs which no apparent CPU usage. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ