ImageMagick vulnerability

[Pierre-Luc]

Major vulnerability, doesn't seem to have a patch yet..

http://arstechnica.com/security/2016/05/easily-exploited-bug-exposes-huge-number-of-sites-to-code-execution-attacks/

[Pierre-Luc]

Also this page tracks the problem and will eventually contain patches: https://imagetragick.com

[horst]

We already check for correct filetypes (imageformats) before processing images. We use PHPs function getimagesize(), what internally uses this magic-byte-check for format detection, I assume. But will check this further.

EDIT: Yes they do: https://github.com/php/php-src/blob/1c295d4a9ac78fcc2f77d6695987598bb7abcb83/ext/standard/image.c#L41

https://github.com/php/php-src/blob/1c295d4a9ac78fcc2f77d6695987598bb7abcb83/ext/standard/image.c#L1246

Edited May 4, 2016 by horst

[DaveP]

Interesting discussion here.

[DaveP]

And some actual payloads analysed here.