Slashdot Mirror
Huge Number Of Sites Imperiled By Critical Image-Processing Vulnerability (arstechnica.com)
Dan Goodin, reporting for Ars Technica: A large number of websites are vulnerable to a simple attack that allows hackers to execute malicious code hidden inside booby-trapped images. The vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users. According to developer and security researcher Ryan Huber, ImageMagick suffers from a vulnerability that allows malformed images to force a Web server to execute code of an attacker's choosing. Websites that use ImageMagick and allow users to upload images are at risk of attacks that could completely compromise their security. "The exploit is trivial, so we expect it to be available within hours of this post," Huber wrote in a blog post. He went on to say: "We have collectively determined that these vulnerabilities are available to individuals other than the person(s) who discovered them. An unknowable number of people having access to these vulnerabilities makes this a critical issue for everyone using this software."
"The exploit is trivial, so we expect it to be available within hours of this post," Huber wrote in a blog post.
Wouldn't it be prudent to get the maintainers for the library to patch first before making it exploit available to the public?
Again, why are we still TODAY writing critical core libraries in what is probably the lease secure language next to raw assembly? Go, Java, even Python would be much better alternatives.
Right, cuz Oracle isn't pumping out a security fix for java every other week.
-- Thou hast strayed far from the path of the Avatar.
FYI, you're an idiot
Written in C
Please tell me, how being written in C is worse than being written in GO, Python and Java?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
It's not really the language, it's the coding.
Like in human language, it's possible to say something grammatically incorrect in any language.
Take your time.
FTA: "They said that recent versions of ImageMagick don't properly filter the uploaded file names before passing them to the server processes such as HTTPS."
Err, why is an image processing library doing network uploads anyway?
Shit! The internet is Nightmare on Elm Street. I'm too scared to leave Slashdot and go out and read the article.
“He’s not deformed, he’s just drunk!”
Why are they much better alternatives?
The software written in (*) has no vulnerabilities?
Choosing a language does not really address security, because that choosing will affect how the programmer thinks about security and possibly the less experienced programmers will slack on "programming for safety" paradigm .. because the language does everything for the programmer.
For example:
Please have a look at fefe's gatling[1], an incredible fast http-server, with only very few security problems in the past - written entierly in "C". Also the funny thing is that certain of these highlevel languages will use bindings to these older libraries written in C.
So you will be bitten again.
From all information I overlook I can say, yes in "C" it is incredible easy to make simple errors with hugh consequences - choosing types for example. However "C"-programming can be made more secure with a strict application of certain rules especially on "forbidden" & dangerous constructions. The missconception why "C" is deemed as an insecure language is that much of the code in use stems from the "ancient" times, when such code was mostly not exposed to the raw unforgiving "force" of the internet.
Also there was not such a "zoo" for other different programming languages, so much of the software was implemented using "C". This effect is similar to todays "I use java now, I don't need to take care of security".
The different incarnations of "C" standards also play their part, similar to the "Perl-Mageddon" if you do not have a concise standard about how a programming language will be "interpreted" or "translated" you are deemed to introduce errors. Imagemagik is bloated & ancient, two aspects that are problematic. Fefe adheres to his own standards, that bloat and complexity are the real threats for security. (dietlibc vs. libc). And he is often correct on this topic.
[1] http://www.fefe.de/
Please tell me, how being written in C is worse than being written in GO, Python and Java?
Simple: Because it could be written in C++.
C++ is a modern language with all the performance of compiled C but with automatic buffer overflow checking, automatic memory management, no dangling pointers, etc.
(Assuming you do it right and don't let any self-entitled C programmers touch the compiler)
No sig today...
There were lots of security fixes for the java applet plugin in those past years, however that's not how java based websites are built. A JVM running in a server it's not the target for that kind of attacks.
It's a command-injection flaw, and any language that is able to call other programs through the shell would be vulnerable, and that includes both Python and Java.
This exploit has nothing to do with pointers or buffer overflows.
It seems to be some kind of parsing error which would not have been mitigated at all by using a different language.
Does anyone else miss the old days of Slashdot when the comments were worth reading? I came into this article with mod points looking for things to upvote, but so far the comment breakdown seems to be 40% lame attempts at jokes, 30% an argument over whether C is a good programming language, 20% trolling, and 10% actual discussion of the bug at hand.
There was a time when the first comment you'd see would be a +5 Insightful comment that had an explanations some of the underlying technical flaws in ImageMagick that lead to the bug, a discussion of why the culture of the dev team was so slow to fix the flaw, and links to alternative libraries that were less prone to security vulnerabilities. How far Slashdot has fallen.
This bug has nothing to do with the language it's written in. It's a simple matter of failing to properly escape special characters when switching contexts (filename -> executable command). You can mess that up in any language.
While fundamentally I agree with you --- it's really a fault of whoever wrote the image parsing logic......I'll counter to say that some languages have a different set of defaults when parsing data, so at a theoretical level, switching languages can help or hinder parsing code. But in the end, those default behaviours can be overridden and still ultimately fall on the developers shoulders to understand and either accept or not.
I'd blame the OS instead. Giving each process full access to the system just isn't a good way to do things and constantly leads to problems like this. Python can stop some those problems, but it provides by no means a secure sandbox. If you access the filesystem in Python, you still have full access to the filesystem. In cases such as this the process should be limited to exactly the data it needs to get the job done, meaning an input image, an output location and a bunch of configuration parameter.
The headline says this is an image processing vulnerability. That makes it sound like someone could put embed code into a PNG/JPG/SVG file or something like that. But skimming the linked articles, it looks more like ImageMagick has a server product with bad URL parsing.
Update your /etc/ImageMagick/policy.xml file so that it contains this (taken from http://imagetragick.com ) and restart corresponding daemons:
/> /> /> /> /> /> /> /> />
<policymap>
<policy domain="coder" rights="none" pattern="EPHEMERAL"
<policy domain="coder" rights="none" pattern="URL"
<policy domain="coder" rights="none" pattern="HTTPS"
<policy domain="coder" rights="none" pattern="MVG"
<policy domain="coder" rights="none" pattern="MSL"
<policy domain="coder" rights="none" pattern="TEXT"
<policy domain="coder" rights="none" pattern="SHOW"
<policy domain="coder" rights="none" pattern="WIN"
<policy domain="coder" rights="none" pattern="PLT"
</policymap>
You're safe now. The full fix is still being worked out.
LOL, Java is written in C
-==- Buy a Mac and leave me alone!
ImageMagick is as old as the hills...
Strictly speaking, those two aren't equivalent. The C example is using dynamic memory with runtime sizing, while the C++ one is using static sizing (and that array would be allocated on the stack). std::vector p would be the C equivalent. Other than that, I agree with you. Pretty much the only reason to use C these days is if your platform doesn't have a good C++ compiler.
vBulletin supports gd by default, but it's no good for large files, and people taking photos on modern smart phones are posting HUGE images. ImageMagick is the quick fix. Its just a radio button to select it, and it fixes many of the resizing problems. Small forums that don't update their software as often as they should will be easily compromised by this for a while.
Turns out we should have been using the better fork since 2002 anyway.
qmail? djbdns?
Can't tell if this is a No true Scottsman or Genetics argument...
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Just a little busy for reading the entirety. Hoping for a synopsis by the indulgent. Thanks for the update.