[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605091454420.27960@freddy.simplesystems.org>
Date: Mon, 9 May 2016 15:03:40 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: GraphicsMagick Response To "ImageTragick"
On Mon, 9 May 2016, Simon McVittie wrote:
>
> Great. Is there an API that can be used to say "load this arbitrary file,
> but only if it is in a format that is considered entirely safe"?
In GraphicsMagick, defining the environment variable
MAGICK_CODER_STABILITY=PRIMARY before running the will block out quite
a lot of functionality (including SVG/MVG/MSL) but nothing can be
considered entirely safe.
> I think the reason people are surprised and concerned to read about the
> MVG and MSL scripting languages is that they enter *Magick through the
> same APIs that open "safe" image files, blurring the boundary between
> "open a file" and "execute a script". If the entry point into executing
> MVG/MSL scripts was named more like ExecuteScript(), as opposed to
> ReadImage(), then I don't think anyone would object to MVG and MSL
> files having arbitrary code execution capabilities.
It is likely that the *Magick name was coined from the header of XPM
files which playfully use the word "magick" as part of the header that
programs would use for header magic testing. This sets the stage for
the automatic things that the software is doing.
In GraphicsMagick, the automatic scary stuff is all done within one
function so it is reasonable to develop a less magical mode which is
less likely to dispatch to a file reader for an archaic file format
which stopped being used in 1993.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
