Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow.

From Red Hat Security Advisory 2006:0633 :

Updated ImageMagick packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Tavis Ormandy discovered several integer and buffer overflow flaws in the way ImageMagick decodes XCF, SGI, and Sun bitmap graphic files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file. (CVE-2006-3743, CVE-2006-3744, CVE-2006-4144)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

A security problem was fixed in ImageMagick during decoding SGI images. The issue in question is CVE-2006-4144 which we addressed before was not completely fixed.

Several security problems have been fixed in ImageMagick :

  - Several heap buffer overflow were found in the Sun     Bitmap decoder of ImageMagick by an audit by the Google     Security Team. This problem could be exploited by an     attacker to execute code. (CVE-2006-3744)

  - Multiple buffer overflows were found in the XCF plugin     due to incorrect bounds checking by the Google Security     Team. This problem could be exploited by an attacker to     execute code. (CVE-2006-3743)

  - A integer overflow in the ReadSGIImage function can be     used by attackers to potentially execute code.
    (CVE-2006-4144)

  - An infinite loop in ImageMagick caused by TransformHSB     was fixed.

  - An infinite loop in handling of TIFF images was fixed.

Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Damian Put discovered a buffer overflow in imagemagick's SGI file format decoder. By tricking an user or automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Maintainance update fixing several security issues and bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security problems have been fixed in ImageMagick :

  - CVE-2006-3744: Several heap buffer overflow were found     in the Sun Bitmap decoder of ImageMagick by an audit by     the Google Security Team. This problem could be     exploited by an attacker to execute code.

  - CVE-2006-3743: Multiple buffer overflows were found in     the XCF handling due to incorrect bounds checking by the     Google Security Team. This problem could be exploited by     an attacker to execute code.

  - CVE-2006-4144: A integer overflow in the ReadSGIImage     function can be used by attackers to potentially execute     code.

  - An infinite loop in ImageMagick caused by TransformHSB     was fixed.

  - An infinite loop in handling of TIFF images was fixed.

Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.

Updated packages have been patched to correct this issue.

Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. (CVE-2006-3743)

Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun bitmap images that trigger heap-based buffer overflows.
(CVE-2006-3744)

Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow. (CVE-2006-4144)

The updated packages have been patched to correct these issues.

Several remote vulnerabilities have been discovered in Imagemagick, a collection of image manipulation programs, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-0082     Daniel Kobras discovered that Imagemagick is vulnerable     to format string attacks in the filename parsing code.

  - CVE-2006-4144     Damian Put discovered that Imagemagick is vulnerable to     buffer overflows in the module for SGI images.

  - CVE-2006-5456     M Joonas Pihlaja discovered that Imagemagick is     vulnerable to buffer overflows in the module for DCM and     PALM images.

  - CVE-2006-5868     Daniel Kobras discovered that Imagemagick is vulnerable     to buffer overflows in the module for SGI images.

This update also addresses regressions in the XCF codec, which were introduced in the previous security update.

The remote host is affected by the vulnerability described in GLSA-200609-14 (ImageMagick: Multiple Vulnerabilities)

    Tavis Ormandy of the Google Security Team discovered a stack and heap     buffer overflow in the GIMP XCF Image decoder and multiple heap and     integer overflows in the SUN bitmap decoder. Damian Put discovered a     heap overflow in the SGI image decoder.
  Impact :

    An attacker may be able to create a specially crafted image that, when     processed with ImageMagick, executes arbitrary code with the privileges     of the executing user.
  Workaround :

    There is no known workaround at this time.

Updated ImageMagick packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Tavis Ormandy discovered several integer and buffer overflow flaws in the way ImageMagick decodes XCF, SGI, and Sun bitmap graphic files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file. (CVE-2006-3743, CVE-2006-3744, CVE-2006-4144)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

ID	Name	Product	Family	Severity
67403	Oracle Linux 4 : ImageMagick (ELSA-2006-0633)	Nessus	Oracle Linux Local Security Checks	medium
29349	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2412)	Nessus	SuSE Local Security Checks	low
29347	SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2048)	Nessus	SuSE Local Security Checks	medium
27969	Ubuntu 5.10 / 6.06 LTS : imagemagick vulnerability (USN-386-1)	Nessus	Ubuntu Local Security Checks	high
27916	Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerability (USN-337-1)	Nessus	Ubuntu Local Security Checks	high
27710	Fedora 7 : GraphicsMagick-1.1.8-2.fc7 (2007-1340)	Nessus	Fedora Local Security Checks	high
27106	openSUSE 10 Security Update : ImageMagick (ImageMagick-2414)	Nessus	SuSE Local Security Checks	low
27104	openSUSE 10 Security Update : ImageMagick (ImageMagick-2006)	Nessus	SuSE Local Security Checks	medium
24607	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:223)	Nessus	Mandriva Local Security Checks	high
23899	Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:155)	Nessus	Mandriva Local Security Checks	high
23662	Debian DSA-1213-1 : imagemagick - several vulnerabilities	Nessus	Debian Local Security Checks	high
22458	GLSA-200609-14 : ImageMagick: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
22292	RHEL 2.1 / 3 / 4 : ImageMagick (RHSA-2006:0633)	Nessus	Red Hat Local Security Checks	medium
22280	CentOS 3 / 4 : ImageMagick (CESA-2006:0633)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2006-4144

high

Tenable Plugins

medium

low

medium

high

high

high

low

medium

high

high

high

medium

medium

medium