[<prev] [next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605081939480.23612@freddy.simplesystems.org>
Date: Sun, 8 May 2016 19:48:49 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: GraphicsMagick Response To "ImageTragick"
The GraphicsMagick project response to the recent "ImageTragick"
(https://imagetragick.com/) exploits may be found in an email posted
to the GraphicsMagick announcements mail list and which may be found
archived here:
"https://sourceforge.net/p/graphicsmagick/mailman/message/35072963/".
The most important concern noted is that a shell exploit is possible
via the "gplt" entry in the delegates.mgk file. While GraphicsMagick
does escape individual Unix shell arguments appropriately, the gnuplot
load request can be used to invoke gnuplot's system() command. The
mere existence of a system() command makes gnuplot files entirely
unsecure and it is a very dangerous format.
Unfortunately, I see that SourceForge converted the several patches
into MS-DOS format.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
