LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandrake: Updated ImageMagick packages Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake A format string vulnerability was discovered in ImageMagick, in the way it handles filenames. An attacker could execute arbitrary code on a victim's machine provided they could trick them into opening a file with a special name (CAN-2005-0397). As well, Andrei Nigmatulin discovered a heap-based buffer overflow in ImageMagick's image handler. An attacker could create a special PhotoShop Document (PSD) image file in such a way that it would cause ImageMagick to execute arbitray code when processing the image (CAN-2005-0005). Other vulnerabilities were discovered in ImageMagick versions prior to 6.0: A bug in the way that ImageMagick handles TIFF tags was discovered.
 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           ImageMagick
 Advisory ID:            MDKSA-2005:065
 Date:                   April 1st, 2005

 Affected versions:	 10.0, 10.1, Corporate 3.0,
			 Corporate Server 2.1
 ______________________________________________________________________

 Problem Description:

 A format string vulnerability was discovered in ImageMagick, in the
 way it handles filenames.  An attacker could execute arbitrary code on
 a victim's machine provided they could trick them into opening a file
 with a special name (CAN-2005-0397).
 
 As well, Andrei Nigmatulin discovered a heap-based buffer overflow in
 ImageMagick's image handler.  An attacker could create a special
 PhotoShop Document (PSD) image file in such a way that it would cause
 ImageMagick to execute arbitray code when processing the image
 (CAN-2005-0005).
 
 Other vulnerabilities were discovered in ImageMagick versions prior
 to 6.0:
 
 A bug in the way that ImageMagick handles TIFF tags was discovered.
 It was possible that a TIFF image with an invalid tag could cause
 ImageMagick to crash (CAN-2005-0759).
 
 A bug in ImageMagick's TIFF decoder was discovered where a specially-
 crafted TIFF image could cause ImageMagick to crash (CAN-2005-0760).
 
 A bug in ImageMagick's PSD parsing was discovered where a specially-
 crafted PSD file could cause ImageMagick to crash (CAN-2005-0761).
 
 Finally, a heap overflow bug was discovered in ImageMagick's SGI
 parser.  If an attacker could trick a user into opening a specially-
 crafted SGI image file, ImageMagick would execute arbitrary code
 (CAN-2005-0762).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0397
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0759
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0760
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0761
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0762
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 6934bcdb04a00c9e8bf278310a4d97a1  10.0/RPMS/ImageMagick-5.5.7.15-6.3.100mdk.i586.rpm
 3a0baa10203d9cd7f29693d70c422411  10.0/RPMS/ImageMagick-doc-5.5.7.15-6.3.100mdk.i586.rpm
 cc4466005fcefc66302e76c380fd3d29  10.0/RPMS/libMagick5.5.7-5.5.7.15-6.3.100mdk.i586.rpm
 4dab1d0e359b30def19dd027e2c9cecc  10.0/RPMS/libMagick5.5.7-devel-5.5.7.15-6.3.100mdk.i586.rpm
 79b4999b37e80b82d3e31ad26db7b90b  10.0/RPMS/perl-Magick-5.5.7.15-6.3.100mdk.i586.rpm
 2ddc8dbc59fd26cdf0654f7393e63acc  10.0/SRPMS/ImageMagick-5.5.7.15-6.3.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 19999eddbba540b711d8286cc63aab13  amd64/10.0/RPMS/ImageMagick-5.5.7.15-6.3.100mdk.amd64.rpm
 d6cc1e5d60cfc7f3e635e3a19cfa39c2  amd64/10.0/RPMS/ImageMagick-doc-5.5.7.15-6.3.100mdk.amd64.rpm
 2d51f1395c4b5bd61b8d2b9e04b8c32e  amd64/10.0/RPMS/lib64Magick5.5.7-5.5.7.15-6.3.100mdk.amd64.rpm
 4efb0e3ea5ce48723af60c27755a8c1e  amd64/10.0/RPMS/lib64Magick5.5.7-devel-5.5.7.15-6.3.100mdk.amd64.rpm
 3063415e823fdba9077d33fdc80d5812  amd64/10.0/RPMS/perl-Magick-5.5.7.15-6.3.100mdk.amd64.rpm
 2ddc8dbc59fd26cdf0654f7393e63acc  amd64/10.0/SRPMS/ImageMagick-5.5.7.15-6.3.100mdk.src.rpm

 Mandrakelinux 10.1:
 9f484abe4c4a273f02e75b326cd75703  10.1/RPMS/ImageMagick-6.0.4.4-5.2.101mdk.i586.rpm
 02f61f0204678e5fbe93bf798650ae30  10.1/RPMS/ImageMagick-doc-6.0.4.4-5.2.101mdk.i586.rpm
 0956e5b16ef8cb9f0679a0e18c6db2b5  10.1/RPMS/libMagick6.4.0-6.0.4.4-5.2.101mdk.i586.rpm
 1d88ee2ab0452d6bfb30998bd3d5b783  10.1/RPMS/libMagick6.4.0-devel-6.0.4.4-5.2.101mdk.i586.rpm
 3e4e9b98225c454b3cc7679cce543efa  10.1/RPMS/perl-Magick-6.0.4.4-5.2.101mdk.i586.rpm
 dcf46d41f345b3cfb35f720191ffee95  10.1/SRPMS/ImageMagick-6.0.4.4-5.2.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 2b233a0f81ffa51aa04cdb2692a9326f  x86_64/10.1/RPMS/ImageMagick-6.0.4.4-5.2.101mdk.x86_64.rpm
 4970da03098334fb083755bf67939360  x86_64/10.1/RPMS/ImageMagick-doc-6.0.4.4-5.2.101mdk.x86_64.rpm
 e83077f3d38232432aa8641dd94ad804  x86_64/10.1/RPMS/lib64Magick6.4.0-6.0.4.4-5.2.101mdk.x86_64.rpm
 db849fd4641def869876a614a24a2ec2  x86_64/10.1/RPMS/lib64Magick6.4.0-devel-6.0.4.4-5.2.101mdk.x86_64.rpm
 12d68cdf7e347606bf9bb70ba6051ce3  x86_64/10.1/RPMS/perl-Magick-6.0.4.4-5.2.101mdk.x86_64.rpm
 dcf46d41f345b3cfb35f720191ffee95  x86_64/10.1/SRPMS/ImageMagick-6.0.4.4-5.2.101mdk.src.rpm

 Corporate Server 2.1:
 b5790a7e928f01d6711cfd29e60df9eb  corporate/2.1/RPMS/ImageMagick-5.4.8.3-2.3.C21mdk.i586.rpm
 12fc1f15675a34018601246dbf48efd1  corporate/2.1/RPMS/libMagick5-5.4.8.3-2.3.C21mdk.i586.rpm
 e70caf4a6f3f7bc68771c78d8322bbfb  corporate/2.1/RPMS/libMagick5-devel-5.4.8.3-2.3.C21mdk.i586.rpm
 514c24bde5b0a9b9f7e9e00c3b29f10e  corporate/2.1/RPMS/perl-Magick-5.4.8.3-2.3.C21mdk.i586.rpm
 2e58703fa9039f43f477738dfca60b50  corporate/2.1/SRPMS/ImageMagick-5.4.8.3-2.3.C21mdk.src.rpm

 Corporate Server 2.1/X86_64:
 b67fb79755ceddb46e334f1633dd7aae  x86_64/corporate/2.1/RPMS/ImageMagick-5.4.8.3-2.3.C21mdk.x86_64.rpm
 f5e945a29810bcc32ac1eca995071fb5  x86_64/corporate/2.1/RPMS/libMagick5-5.4.8.3-2.3.C21mdk.x86_64.rpm
 80f7085bc6e4b2e0f2ce329d4fbd84a1  x86_64/corporate/2.1/RPMS/libMagick5-devel-5.4.8.3-2.3.C21mdk.x86_64.rpm
 62013e17a37016ed6d1399873315aeb0  x86_64/corporate/2.1/RPMS/perl-Magick-5.4.8.3-2.3.C21mdk.x86_64.rpm
 2e58703fa9039f43f477738dfca60b50  x86_64/corporate/2.1/SRPMS/ImageMagick-5.4.8.3-2.3.C21mdk.src.rpm

 Corporate 3.0:
 2b6b1cf0015a34fa11ca7705a699510e  corporate/3.0/RPMS/ImageMagick-5.5.7.15-6.3.C30mdk.i586.rpm
 561ce007678557f825ebff37b1428412  corporate/3.0/RPMS/ImageMagick-doc-5.5.7.15-6.3.C30mdk.i586.rpm
 53d43d1df6bdf4165f4e6f91ce7d0db2  corporate/3.0/RPMS/libMagick5.5.7-5.5.7.15-6.3.C30mdk.i586.rpm
 c87ac116fb584684a767b98f6afa3075  corporate/3.0/RPMS/libMagick5.5.7-devel-5.5.7.15-6.3.C30mdk.i586.rpm
 f167bc2e68e9c0dd50d5194b0eb4a94c  corporate/3.0/RPMS/perl-Magick-5.5.7.15-6.3.C30mdk.i586.rpm
 b28bb96208961dba1afe76667d993051  corporate/3.0/SRPMS/ImageMagick-5.5.7.15-6.3.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 74b8532afa8187eff8a8a2bdf954c638  x86_64/corporate/3.0/RPMS/ImageMagick-5.5.7.15-6.3.C30mdk.x86_64.rpm
 637c470bfcba18f87d7e4f64a261fde4  x86_64/corporate/3.0/RPMS/ImageMagick-doc-5.5.7.15-6.3.C30mdk.x86_64.rpm
 6d182fc7976de33b1cd9a5a293ebe81e  x86_64/corporate/3.0/RPMS/lib64Magick5.5.7-5.5.7.15-6.3.C30mdk.x86_64.rpm
 feecb9d9b44fb683e0daf6701ea9cf7e  x86_64/corporate/3.0/RPMS/lib64Magick5.5.7-devel-5.5.7.15-6.3.C30mdk.x86_64.rpm
 919e98e64fe436674016a48142ab0ebd  x86_64/corporate/3.0/RPMS/perl-Magick-5.5.7.15-6.3.C30mdk.x86_64.rpm
 b28bb96208961dba1afe76667d993051  x86_64/corporate/3.0/SRPMS/ImageMagick-5.5.7.15-6.3.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Hackers encrypted the entire City of Detroit DataBase & demanded ransom of 2000 bitcoins ($803,500)
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.