SB2016050301 - Multiple vulnerabilities in ImageMagick

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Server Side Request Forgery (CVE-ID: CVE-2016-3718)

The vulnerability allows a remote attacker to perform server-side forgery attacks and compromise vulnerable application.

The weakness exists due to the failure to properly prevent the disclosure of file contents when processing certain MVG files. A remote attacker can persuade the victim to open specially crafted images using the .mvg file to trick the victim host into performing HTTP requests or opening FTP sessions.

Successful exploitation of this vulnerability may allow an attacker to perform SSRF attack to retrieve information for further attacks against vulnerable system by performing unauthorized connections to local resources, gain access to sensitive information and compromise vulnerable system.

2) Information disclosure (CVE-ID: CVE-2016-3717)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the failure to properly prevent the disclosure of file contents when processing certain MVG files. A remote attacker can create a specially crafted image, trick the victim into opening it, generate output files and obtain sensitive information.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

3) Security bypass (CVE-ID: CVE-2016-3716)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the failure to properly prevent file move operations when processing certain MVG files. A remote attacker can create a specially crafted image, trick the victim into opening, bypass security mechanism and move certain files on the affected system.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

4) Input validation error (CVE-ID: CVE-2016-3715)

The vulnerability allows a remote attacker to delete arbitrary files on the target system.

The weakness exists due to input validation error. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger an error in the ephemeral pseudo-protocol and delete certain files on the affected system.

Successful exploitation of the vulnerability results in deletion of arbitrary files on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://imagetragick.com/