Huge number of sites imperiled by critical image-processing vulnerability

Nicolas Hoizey CC BY-NC-SA 4/05/2016

Huge number of sites imperiled by critical image-processing vulnerability
▻http://arstechnica.com/security/2016/05/easily-exploited-bug-exposes-huge-number-of-sites-to-code-execution-att

“According to developer and security researcher Ryan Huber, ImageMagick suffers from a vulnerability that allows malformed images to force a Web server to execute code of an attacker’s choosing. Websites that use ImageMagick and allow users to upload images are at risk of attacks that could completely compromise their security.”

#ImageMagick_image_sécurité_faille_clevermarks

Nicolas Hoizey CC BY-NC-SA

b_b @b_b PUBLIC DOMAIN 4/05/2016

Et la faille a un ty nom et son propre site comme c’est la mode depuis quelques temps :
►https://imagetragick.com
If you use ImageMagick or an affected library, we recommend you mitigate the known vulnerabilities by doing at least one of these two things (but preferably both!):
1) Verify that all image files begin with the expected “magic bytes” corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
2) Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.

b_b @b_b PUBLIC DOMAIN
Stéphane Bortzmeyer @stephane CC BY-SA 6/05/2016

Est-ce que SeenThis utilise ImageMagick pour le traitement des images affichées ? Si oui, il faudrait patcher d’urgence.

Stéphane Bortzmeyer @stephane CC BY-SA
Fil @fil 6/05/2016

j’ai fait la modif hier dans /etc/ImageMagick/ en espérant que ça suffise

Fil @fil

Écrire un commentaire