Detections
Analytics
Debian DSA-957-2 : imagemagick - missing shell meta sanitising
high Nessus Plugin ID 22823
Synopsis
The remote Debian host is missing a security-related update.Description
Florian Weimer discovered that delegate code in ImageMagick is vulnerable to shell command injection using specially crafted file names. This allows attackers to encode commands inside of graphic commands. With some user interaction, this is exploitable through Gnus and Thunderbird. This update filters out the '$' character as well, which was forgotten in the former update.Solution
Upgrade the imagemagick packages.For the old stable distribution (woody) this problem has been fixed in version 5.4.4.5-1woody8.
For the stable distribution (sarge) this problem has been fixed in version 6.0.6.2-2.6.
See Also
Plugin Details
Severity: High
ID: 22823
File Name: debian_DSA-957.nasl
Version: 1.21
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/14/2006
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:imagemagick, cpe:/o:debian:debian_linux:3.0, cpe:/o:debian:debian_linux:3.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/29/2005
Reference Information
CVE: CVE-2005-4601
BID: 16093
DSA: 957