[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1605191433400.15930@freddy.simplesystems.org>
Date: Thu, 19 May 2016 14:51:58 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714
On Thu, 19 May 2016, Simon McVittie wrote:
>
> Having looked into it a bit for Debian, there are several factors:
>
> * mitigations exist, like you said
The problem is that most users don't know about the problem, the
mitigations, or are even aware that they are using the software.
They do know about periodic application of security updates.
Regarding the comments from Kurt Seifried about the supposed perils of
MVG:
Unless ImageMagick is configured to use RSVG (as it often is), then it
will use its own built in SVG renderer by default (the built in one is
still available with a "MSVG:" prefix to the filename or possibly the
file extension). The SVG renderer operates by translating the SVG
into MVG, including the URLs. The translation is not secure in that
arbitrary MVG may be injected via SVG through text strings. SVG is a
common file exchange format found on the web and often opened outside
of web browsers.
> * many of the upstream fixes in ImageMagick (and GraphicsMagick)
> are really just mitigations too, and they remove features that someone
> could conceivably have been using, which rather goes against the idea
> of a stable release with a fixed feature-set
Agreed.
> Bob, if you would like distributions to pick up GraphicsMagick security
> fixes in a timely way, it would probably be really useful to do an
> upstream release - distributions are typically a lot more confident about
I do plan to make a release, but want to make sure that the release is
of no less quality than other releases. I want to remove the current
render/MVG "mitigation" regarding magick-specific syntax and provide a
"safer" operating mode which protects against magick-specific syntax
when it is used for formats with expected behavior like SVG. The
"safer" mode may have general purpose value outside of MVG.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
