oss-security - ImageMagick identify "d:" hangs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.GSO.2.20.1609270837170.5577@freddy.simplesystems.org>
Date: Tue, 27 Sep 2016 08:48:42 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: ImageMagick identify "d:" hangs

Today I noticed ImageMagick issue #275 
(https://github.com/ImageMagick/ImageMagick/issues/275) which was 
posted 4 days ago.   I was able to reproduce this issue with the 
ImageMagick provided by my Ubuntu system (6.8.9-9).

The problem is that a file name ending with a colon (':') causes the 
program to hang forever.  If an attacker is able to have some control 
over the input file name, then this could be used to cause DOS by 
hanging the program.

The following is the text from the problem report:

   qwerty4030 commented 4 days ago • edited
   Version: ImageMagick 6.9.3-10 Q16 x86_64 2016-05-04
   http://www.imagemagick.org
   Copyright: Copyright (C) 1999-2016 ImageMagick Studio LLC
   License: http://www.imagemagick.org/script/license.php
   Features: Cipher DPC OpenMP
   Delegates (built-in): jng jpeg lzma png tiff xml zlib

   OS: 4.4.10-22.54.amzn1.x86_64 (amazon linux)

   identify hangs on the following commands:

   identify "d:" (no output, just hangs forever)
   identify "d::" (no output, just hangs forever)
   identify "http:"
   error : Unknown IO error (hangs after this message)
   identify "http::"
   error : Unknown IO error (hangs after this message)

>From my own investigations, I used

   identify -debug all "d:"

and see that a temporary file is reported to be created and then the 
program hangs which no apparent CPU usage.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.