Security ImageMagick vulnerabilities CVE-2016-3714 (imagetragick) active exploitation confirmed

Revenge · May 4, 2016

ImageMagick vulnerabilities place countless websites at risk, active exploitation confirmed | CSO Online

ImageTragick

pamamolf · May 4, 2016

Is it patched on latest versions?

Does a yum update keep us safe?

Revenge · May 4, 2016

Not yet i think.

eva2000 · May 4, 2016

Update: for Centmin Mod LEMP users, yum has update for fixed ImageMagick 6.9.3-10 version of the system package - see details here

Follow instructions at ImageMagick Security Issue - ImageMagick should be sufficient - updated by Redhat to extend the policy.xml at Security - ImageMagick vulnerabilities place countless websites at risk, active exploitation confirmed | Page 2 | Centmin Mod Community

before

Code (Text):

convert -list policy

Path: /etc/ImageMagick-last/ImageMagick-6/policy.xml
  Policy: Unrecognized
    rights: None

Path: [built-in]
  Policy: Undefined
    rights: None

after editing /etc/ImageMagick-last/ImageMagick-6/policy.xml

Code (Text):

convert -list policy                                        
Path: /etc/ImageMagick-last/ImageMagick-6/policy.xml
  Policy: Unrecognized
    rights: None
  Policy: Coder
    rights: None
    pattern: EPHEMERAL
  Policy: Coder
    rights: None
    pattern: HTTPS
  Policy: Coder
    rights: None
    pattern: HTTP
  Policy: Coder
    rights: None
    pattern: URL
  Policy: Coder
    rights: None
    pattern: FTP
  Policy: Coder
    rights: None
    pattern: MVG
  Policy: Coder
    rights: None
    pattern: MSL
  Policy: Coder
    rights: None
    pattern: TEXT
  Policy: Coder
    rights: None
    pattern: LABEL
  Policy: Path
    rights: None
    pattern: @*

Path: [built-in]
  Policy: Undefined
    rights: None

and fixed ImageMagick 6.9.3-10

Code (Text):

php --ri imagick

imagick

imagick module => enabled
imagick module version => 3.4.2
imagick classes => Imagick, ImagickDraw, ImagickPixel, ImagickPixelIterator, ImagickKernel
Imagick compiled with ImageMagick version => ImageMagick 6.9.3-10 Q16 x86_64 2016-05-04 http://www.imagemagick.org
Imagick using ImageMagick library version => ImageMagick 6.9.3-10 Q16 x86_64 2016-05-04 http://www.imagemagick.org
ImageMagick copyright => Copyright (C) 1999-2016 ImageMagick Studio LLC
ImageMagick release date => 2016-05-04
ImageMagick number of supported formats:  => 225
ImageMagick supported formats => 3FR, AAI, AI, ART, ARW, AVI, AVS, BGR, BGRA, BGRO, BIE, BMP, BMP2, BMP3, BRF, CAL, CALS, CANVAS, CAPTION, CIN, CIP, CLIP, CMYK, CMYKA, CR2, CRW, CUR, CUT, DATA, DCM, DCR, DCX, DDS, DFONT, DNG, DOT, DPX, DXT1, DXT5, EPDF, EPI, EPS, EPS2, EPS3, EPSF, EPSI, EPT, EPT2, EPT3, ERF, EXR, FAX, FITS, FRACTAL, FTS, G3, GIF, GIF87, GRADIENT, GRAY, GROUP4, GV, H, HALD, HDR, HISTOGRAM, HRZ, HTM, HTML, ICB, ICO, ICON, IIQ, INFO, INLINE, IPL, ISOBRL, ISOBRL6, JBG, JBIG, JNG, JNX, JPE, JPEG, JPG, JPS, JSON, K25, KDC, LABEL, M2V, M4V, MAC, MAGICK, MAP, MASK, MAT, MATTE, MEF, MIFF, MKV, MNG, MONO, MOV, MP4, MPC, MPEG, MPG, MRW, MSL, MSVG, MTV, MVG, NEF, NRW, NULL, ORF, OTB, OTF, PAL, PALM, PAM, PANGO, PATTERN, PBM, PCD, PCDS, PCL, PCT, PCX, PDB, PDF, PDFA, PEF, PES, PFA, PFB, PFM, PGM, PICON, PICT, PIX, PJPEG, PLASMA, PNG, PNG00, PNG24, PNG32, PNG48, PNG64, PNG8, PNM, PPM, PREVIEW, PS, PS2, PS3, PSB, PSD, PTIF, PWP, RADIAL-GRADIENT, RAF, RAS, RAW, RGB, RGBA, RGBO, RGF, RLA, RLE, RMF, RW2, SCR, SCT, SFW, SGI, SHTML, SIX, SIXEL, SPARSE-COLOR, SR2, SRF, STEGANO, SUN, SVG, SVGZ, TEXT, TGA, THUMBNAIL, TIFF, TIFF64, TILE, TIM, TTC, TTF, TXT, UBRL, UBRL6, UIL, UYVY, VDA, VICAR, VID, VIFF, VIPS, VST, WBMP, WEBP, WMF, WMV, WMZ, WPG, X, X3F, XBM, XC, XCF, XPM, XPS, XV, XWD, YCbCr, YCbCrA, YUV

Directive => Local Value => Master Value
imagick.locale_fix => 0 => 0
imagick.skip_version_check => 0 => 0
imagick.progress_monitor => 0 => 0

pamamolf · May 4, 2016

Patch will be release on the weekend as i can read....

A simple yum update will catch it when is out?

eva2000 · May 4, 2016

Not yet

after the file edit above and yum update to fixed version when it is released, run centmin.sh menu option 15 to recompile imagick php extension too

Code (Text):

--------------------------------------------------------
Centmin Mod 1.2.3-eva2000.09 - http://centminmod.com
--------------------------------------------------------
                   Centmin Mod Menu                   
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu
12). Zend OpCache Install/Re-install
13). Install ioping.sh vbtechsupport.com/1239/
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2...
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Re-install
21). Update - Nginx + PHP-FPM + Siege
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 15
--------------------------------------------------------

pamamolf · May 4, 2016

After the file edit above do i have to recompile it so the changes will be activated?

eva2000 · May 4, 2016

pamamolf said: ↑

After the file edit above do i have to recompile it so the changes will be activated?
Click to expand...

i'd recompile as imagemagick system package as remi had an update recently too - should auto update when you run centmin.sh menu option 15

eva2000 · May 4, 2016

nice read

oss-security - Re: ImageMagick Is On Fire -- CVE-2016-3714

ImageTragick Exploit Used in Attacks to Compromise Sites via ImageMagick 0-Day

Hackers only need to find websites that allow users to upload photos

Because ImageMagick is at the base of many image processing libraries and modules, used across a large number of programming languages like Ruby, JavaScript, PHP, Java, and more, any website, running on any platform is vulnerable to this zero-day.

The only condition is that users are allowed to upload files to the server, and a large number of websites do via "user avatar" options.

The researchers declined to reveal any clues regarding the exploitation routine, but based on the mitigation advice, it involves magic bytes and ImageMagick coders.

Magic bytes are the first few bytes of a file used programmatically to identify the image type (GIF, JPEG, PNG, etc.). ImageMagick coders are ImageMagick modules that read and write data to specific image file types.

The researchers said that there's an RCE (Remote Code Execution) bug somewhere in there, that allows attackers to write code to the server. If an attacker is skilled enough, he can upload a malicious image, which uses the zero-day to write a webshell to disk and uses it to take over control of the entire server.
Click to expand...

Already deployed workaround on all my servers + all my paying clients' servers

Shaiffulnizam Mohamad · May 4, 2016

Tq Eva, already patching my server too.

Matt · May 4, 2016

All fun and games!

deltahf · May 4, 2016

Thanks guys. Just patched my server as well. I'll keep an eye out for the updates this weekend.

I've always been suspicious of these image manipulation libraries... they seem like such ripe targets. I'd say this exploit will be heavily abused for a long time to come.

pamamolf · May 4, 2016

I did also the edit and recompile but as i can read they may be more security issues on the Imagemagick.....

So we must keep a close eye on it....

deltahf · May 4, 2016

To be safe, I'd recommend switching any XenForo installations over to the PHP GD image library for now.

It's in Options -> Attachments in the XenForo admin panel. I've always used the GD library and it has worked well for me.

eva2000 · May 4, 2016

pamamolf said: ↑

I did also the edit and recompile but as i can read they may be more security issues on the Imagemagick.....

So we must keep a close eye on it....
Click to expand...

read oss-security - Re: ImageMagick Is On Fire -- CVE-2016-3714

deltahf said: ↑

To be safe, I'd recommend switching any XenForo installations over to the PHP GD image library for now.
Click to expand...

already did here

Matt · May 4, 2016

I was already using GD. I don't see any need to use imagick unless you are running XFMG.

pamamolf · May 4, 2016

Is there any related setting to use GD on IPB also?

What IPB is using by default?

deltahf · May 4, 2016

Matt said: ↑

I was already using GD. I don't see any need to use imagick unless you are running XFMG.
Click to expand...

Yeah, even then, I believe it's only required if you want to use the watermarking feature.

Revenge · May 4, 2016

I have changed my sites from using ImageMagick to GD. I will only change it back, when the new version is released.

Revenge · May 4, 2016

pamamolf said: ↑

Is there any related setting to use GD on IPB also?

What IPB is using by default?
Click to expand...

IPB Default is GD. But i was using ImageMagick. We can change it in the ACP.

Log in / Register

Forums

Welcome to Centmin Mod Community

Security ImageMagick vulnerabilities CVE-2016-3714 (imagetragick) active exploitation confirmed

Revenge Active Member

pamamolf Premium Member Premium Member

Revenge Active Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Shaiffulnizam Mohamad New Member

Matt Well-Known Member

deltahf Premium Member Premium Member

pamamolf Premium Member Premium Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

Matt Well-Known Member

pamamolf Premium Member Premium Member

deltahf Premium Member Premium Member

Revenge Active Member

Revenge Active Member

.

Log in / Register

Useful Searches

Welcome to Centmin Mod Community

Security ImageMagick vulnerabilities CVE-2016-3714 (imagetragick) active exploitation confirmed

Revenge Active Member

pamamolf Premium Member Premium Member

Revenge Active Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

pamamolf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Shaiffulnizam Mohamad New Member

Matt Well-Known Member

deltahf Premium Member Premium Member

pamamolf Premium Member Premium Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

Matt Well-Known Member

pamamolf Premium Member Premium Member

deltahf Premium Member Premium Member

Revenge Active Member

Revenge Active Member

.