Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun Rasterfile (bitmap) images that trigger heap-based buffer overflows.

From Red Hat Security Advisory 2006:0633 :

Updated ImageMagick packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Tavis Ormandy discovered several integer and buffer overflow flaws in the way ImageMagick decodes XCF, SGI, and Sun bitmap graphic files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file. (CVE-2006-3743, CVE-2006-3744, CVE-2006-4144)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Several security problems have been fixed in ImageMagick :

  - Several heap buffer overflow were found in the Sun     Bitmap decoder of ImageMagick by an audit by the Google     Security Team. This problem could be exploited by an     attacker to execute code. (CVE-2006-3744)

  - Multiple buffer overflows were found in the XCF plugin     due to incorrect bounds checking by the Google Security     Team. This problem could be exploited by an attacker to     execute code. (CVE-2006-3743)

  - A integer overflow in the ReadSGIImage function can be     used by attackers to potentially execute code.
    (CVE-2006-4144)

  - An infinite loop in ImageMagick caused by TransformHSB     was fixed.

  - An infinite loop in handling of TIFF images was fixed.

Tavis Ormandy discovered several buffer overflows in imagemagick's Sun Raster and XCF (Gimp) image decoders. By tricking a user or automated system into processing a specially crafted image, this could be exploited to execute arbitrary code with the users' privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security problems have been fixed in ImageMagick :

  - CVE-2006-3744: Several heap buffer overflow were found     in the Sun Bitmap decoder of ImageMagick by an audit by     the Google Security Team. This problem could be     exploited by an attacker to execute code.

  - CVE-2006-3743: Multiple buffer overflows were found in     the XCF handling due to incorrect bounds checking by the     Google Security Team. This problem could be exploited by     an attacker to execute code.

  - CVE-2006-4144: A integer overflow in the ReadSGIImage     function can be used by attackers to potentially execute     code.

  - An infinite loop in ImageMagick caused by TransformHSB     was fixed.

  - An infinite loop in handling of TIFF images was fixed.

Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. (CVE-2006-3743)

Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun bitmap images that trigger heap-based buffer overflows.
(CVE-2006-3744)

Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow. (CVE-2006-4144)

The updated packages have been patched to correct these issues.

Several remote vulnerabilities have been discovered in Imagemagick, a collection of image manipulation tools, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2440     Eero Hakkinen discovered that the display tool     allocates insufficient memory for globbing patterns,     which might lead to a buffer overflow.

  - CVE-2006-3743     Tavis Ormandy from the Google Security Team discovered     that the Sun bitmap decoder performs insufficient input     sanitising, which might lead to buffer overflows and the     execution of arbitrary code.

  - CVE-2006-3744     Tavis Ormandy from the Google Security Team discovered     that the XCF image decoder performs insufficient input     sanitising, which might lead to buffer overflows and the     execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200609-14 (ImageMagick: Multiple Vulnerabilities)

    Tavis Ormandy of the Google Security Team discovered a stack and heap     buffer overflow in the GIMP XCF Image decoder and multiple heap and     integer overflows in the SUN bitmap decoder. Damian Put discovered a     heap overflow in the SGI image decoder.
  Impact :

    An attacker may be able to create a specially crafted image that, when     processed with ImageMagick, executes arbitrary code with the privileges     of the executing user.
  Workaround :

    There is no known workaround at this time.

Updated ImageMagick packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Tavis Ormandy discovered several integer and buffer overflow flaws in the way ImageMagick decodes XCF, SGI, and Sun bitmap graphic files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file. (CVE-2006-3743, CVE-2006-3744, CVE-2006-4144)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

ID	Name	Product	Family	Severity
67403	Oracle Linux 4 : ImageMagick (ELSA-2006-0633)	Nessus	Oracle Linux Local Security Checks	medium
29347	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2048)	Nessus	SuSE Local Security Checks	medium
27919	Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerabilities (USN-340-1)	Nessus	Ubuntu Local Security Checks	medium
27104	openSUSE 10 Security Update : ImageMagick (ImageMagick-2006)	Nessus	SuSE Local Security Checks	medium
23899	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:155)	Nessus	Mandriva Local Security Checks	high
22710	Debian DSA-1168-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	high
22458	GLSA-200609-14 : ImageMagick: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
22292	RHEL 2.1 / 3 / 4 : ImageMagick (RHSA-2006:0633)	Nessus	Red Hat Local Security Checks	medium
22280	CentOS 3 / 4 : ImageMagick (CESA-2006:0633)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2006-3744

critical

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

medium