|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: ImageMagick, GraphicsMagick: ghostscript: various issues bypassing -dSAFER | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Marcus Meissner <meissner> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | danilo.godec, meissner, msvec, onalmpantis, pgajdos, suse-beta |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Marcus Meissner
2018-08-22 06:08:58 UTC
so if we currently do not disable ghostscript in imagemagick or graphicsmagic, I would now say we should start doing so. This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/630850 Factory / ImageMagick This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/630883 Factory / ImageMagick This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/630927 15.0 / GraphicsMagick https://build.opensuse.org/request/show/630929 42.3 / GraphicsMagick BEFORE TW,15,12/ImageMagick, $ convert rose: rose.pdf $ convert rose: rose.xps $ convert rose: rose.eps $ convert rose: rose.ps $ 11/ImageMagick $ convert rose: rose.pdf; file rose.pdf rose.pdf: PDF document, version 1.3 $ convert rose: rose.ps; file rose.ps rose.ps: PostScript document text conforming DSC level 3.0, Level 1 $ convert rose: rose.eps; file rose.eps rose.eps: PostScript document text conforming DSC level 3.0, type EPS, Level 1 $ 42.3,15.0,TW/GraphicsMagick $ gm convert rose: rose.pdf; file rose.pdf rose.pdf: PDF document, version 1.2 $ gm convert rose: rose.ps; file rose.ps rose.ps: PostScript document text conforming DSC level 3.0, Level 1 $ gm convert rose: rose.eps; file rose.eps rose.eps: PostScript document text conforming DSC level 3.0, type EPS, Level 1 $ AFTER TW,15,12/ImageMagick $ convert rose: rose.pdf convert: not authorized `rose.pdf' @ error/constitute.c/WriteImage/1048. $ convert rose: rose.xps convert: not authorized `rose.xps' @ error/constitute.c/WriteImage/1048. $ convert rose: rose.eps convert: not authorized `rose.eps' @ error/constitute.c/WriteImage/1048. $ convert rose: rose.ps convert: not authorized `rose.ps' @ error/constitute.c/WriteImage/1048. $ 11/ImageMagick $ convert rose: rose.pdf; file rose.pdf rose.pdf: ASCII C program text $ convert rose: rose.eps; file rose.eps rose.eps: ASCII C program text $ convert rose: rose.ps; file rose.ps rose.ps: ASCII C program text $ 11,42.3,15.0,TW/GraphicsMagick $ gm convert rose: rose.pdf; file rose.pdf rose.pdf: Netpbm image data, size = 70 x 46, rawbits, pixmap $ gm convert rose: rose.ps; file rose.ps rose.ps: Netpbm image data, size = 70 x 46, rawbits, pixmap $ gm convert rose: rose.eps; file rose.eps rose.eps: Netpbm image data, size = 70 x 46, rawbits, pixmap $ Original behavior can be obtained by removing respective lines from policy.xml for TW,15,12/ImageMagick, using MAGICK_CODER_MODULE_PATH for 11/ImageMagick and 11/GraphicsMagick (see bug 978061 comment 43) or using MAGICK_CODER_STABILITY=BROKEN for 42.3,15.0,TW/GraphicsMagick (bug 978061 comment 13). Packages submitted: TW,15,12,11/ImageMagick and TW,15.0,42.3,11/GraphicsMagick. This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/631020 Factory / GraphicsMagick openSUSE-SU-2018:2516-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: openSUSE Leap 42.3 (src): GraphicsMagick-1.3.25-99.1 openSUSE Leap 15.0 (src): GraphicsMagick-1.3.29-lp150.3.9.1 SUSE-SU-2018:2553-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): ImageMagick-6.4.3.6-78.59.1 SUSE Linux Enterprise Server 11-SP4 (src): ImageMagick-6.4.3.6-78.59.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): ImageMagick-6.4.3.6-78.59.1 SUSE-SU-2018:2560-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: SUSE Studio Onsite 1.3 (src): GraphicsMagick-1.2.5-78.66.2 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): GraphicsMagick-1.2.5-78.66.2 SUSE Linux Enterprise Debuginfo 11-SP4 (src): GraphicsMagick-1.2.5-78.66.2 SUSE-SU-2018:2562-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: SUSE Linux Enterprise Module for Development Tools 15 (src): ImageMagick-7.0.7.34-3.17.1 SUSE Linux Enterprise Module for Desktop Applications 15 (src): ImageMagick-7.0.7.34-3.17.1 openSUSE-SU-2018:2600-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: openSUSE Leap 15.0 (src): ImageMagick-7.0.7.34-lp150.2.12.1 SUSE-SU-2018:2778-1: An update that solves 6 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1102003,1102004,1102005,1102007,1105592,1106855,1106858 CVE References: CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,CVE-2018-16329 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): ImageMagick-6.8.8.1-71.74.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): ImageMagick-6.8.8.1-71.74.1 SUSE Linux Enterprise Server 12-SP3 (src): ImageMagick-6.8.8.1-71.74.1 SUSE Linux Enterprise Desktop 12-SP3 (src): ImageMagick-6.8.8.1-71.74.1 openSUSE-SU-2018:2516-2: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: openSUSE Backports SLE-15 (src): GraphicsMagick-1.3.29-bp150.2.3.1 openSUSE-SU-2018:2811-1: An update that solves 6 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1102003,1102004,1102005,1102007,1105592,1106855,1106858 CVE References: CVE-2018-14434,CVE-2018-14435,CVE-2018-14436,CVE-2018-14437,CVE-2018-16323,CVE-2018-16329 Sources used: openSUSE Leap 42.3 (src): ImageMagick-6.8.8.1-67.1 Should the workarounds mentioned in comment 6 still work with the latest packages? They don't seem to. :( Typo3 (https://typo3.org/), for example, relies on functionality of converting PDF to JPG, so this will break a lot of sites. (In reply to Danilo Godec from comment #25) > Should the workarounds mentioned in comment 6 still work with the latest > packages? They don't seem to. :( > > Typo3 (https://typo3.org/), for example, relies on functionality of > converting PDF to JPG, so this will break a lot of sites. The file /usr/lib64/GraphicsMagick-1.3.25/config/delegates.mgk has changed too, so I had to bring the old version back from backup, along with a 'wrapper' script to add the MAGICK_CODER_STABILITY=BROKEN. This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/639374 Factory / ImageMagick (In reply to Danilo Godec from comment #26) > The file /usr/lib64/GraphicsMagick-1.3.25/config/delegates.mgk has changed > too, so I had to bring the old version back from backup, along with a > 'wrapper' script to add the MAGICK_CODER_STABILITY=BROKEN. Ok, sorry I had not mentioned it. Marcus, we disabled coders for both reading and writing. Perhaps we could relax the rules just for reading? (In reply to Petr Gajdos from comment #29) > Marcus, > > we disabled coders for both reading and writing. Perhaps we could relax the > rules just for reading? .. rules just to disable reading? we can allow writing / coonverting TO postscript I think. only evaluating postscriopt (so reading) via ghostscript is unsafe Okay. So after upcomming change we will have: $ convert rose: rose.eps $ convert rose.eps rose.png convert: not authorized `EPS' @ error/constitute.c/IsCoderAuthorized/408. convert: no images defined `rose.png' @ error/convert.c/ConvertImageCommand/3288. $ It is perhaps little misleading, but more relaxed for these who just want to convert image to pdf for example. It is applicable for 12,15,TW/ImageMagick only though. Packages submitted again to TW, 15 and 12. This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/639725 Factory / ImageMagick SUSE-SU-2018:3072-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: SUSE Linux Enterprise Module for Development Tools 15 (src): ImageMagick-7.0.7.34-3.27.1 SUSE Linux Enterprise Module for Desktop Applications 15 (src): ImageMagick-7.0.7.34-3.27.1 openSUSE-SU-2018:3094-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 1105592 CVE References: Sources used: openSUSE Leap 15.0 (src): ImageMagick-7.0.7.34-lp150.2.18.1 SUSE-SU-2018:3095-1: An update that solves 9 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1050129,1105592,1106989,1107604,1107609,1107612,1107616,1107619,1108282,1108283 CVE References: CVE-2017-11532,CVE-2018-16413,CVE-2018-16640,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,CVE-2018-16749,CVE-2018-16750 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP3 (src): ImageMagick-6.8.8.1-71.79.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): ImageMagick-6.8.8.1-71.79.1 SUSE Linux Enterprise Server 12-SP3 (src): ImageMagick-6.8.8.1-71.79.1 SUSE Linux Enterprise Desktop 12-SP3 (src): ImageMagick-6.8.8.1-71.79.1 openSUSE-SU-2018:3203-1: An update that solves 9 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1050129,1105592,1106989,1107604,1107609,1107612,1107616,1107619,1108282,1108283 CVE References: CVE-2017-11532,CVE-2018-16413,CVE-2018-16640,CVE-2018-16642,CVE-2018-16643,CVE-2018-16644,CVE-2018-16645,CVE-2018-16749,CVE-2018-16750 Sources used: openSUSE Leap 42.3 (src): ImageMagick-6.8.8.1-70.2 (In reply to Marcus Meissner from comment #42) > TID https://www.suse.com/support/kb/doc/?id=7023657 Marcus: there is another way how to expose vulnerable coders in SLE 11: MAGICK_CODER_MODULE_PATH see the last paragraph of comment 6. Using a wrapper that will mean permanent solution for customers as opposed to moving coders from one directory to another. (In reply to Petr Gajdos from comment #43) > (In reply to Marcus Meissner from comment #42) > > TID https://www.suse.com/support/kb/doc/?id=7023657 > > Marcus: there is another way how to expose vulnerable coders in SLE 11: > > MAGICK_CODER_MODULE_PATH > > see the last paragraph of comment 6. Using a wrapper that will mean > permanent solution for customers as opposed to moving coders from one > directory to another. Marcus, ping. i asked hans to add it there This is an autogenerated message for OBS integration: This bug (1105592) was mentioned in https://build.opensuse.org/request/show/705902 15.1 / GraphicsMagick we solved this by having different config files |