Information disclosure in ImageMagick - CVE-2016-3717

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU5849

Information disclosure in ImageMagick - CVE-2016-3717

Published: February 17, 2017 / Updated: September 14, 2018


Vulnerability identifier: #VU5849
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3717
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the failure to properly prevent the disclosure of file contents when processing certain MVG files. A remote attacker can create a specially crafted image, trick the victim into opening it, generate output files and obtain sensitive information.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Affected software

ImageMagick
Gentoo Linux
Amazon Linux AMI
SUSE Linux
Ubuntu
Slackware Linux
Opensuse
imagemagick (Ubuntu package)
libmagickcore4 (Ubuntu package)
libmagick++4 (Ubuntu package)
imagemagick-common (Ubuntu package)
libmagickcore5 (Ubuntu package)
libmagick++5 (Ubuntu package)
libmagickcore-6.q16-2 (Ubuntu package)
imagemagick-6.q16 (Ubuntu package)
libmagick++-6.q16-5v5 (Ubuntu package)

How to mitigate CVE-2016-3717

Update to version 6.9.3-10 or 7.0.1-1.

imagemagick (Ubuntu package) - addressed in versions 8:6.6.9.7-5ubuntu3.4, 8:6.7.7.10-6ubuntu3.1, 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagickcore4 (Ubuntu package) - update to 8:6.6.9.7-5ubuntu3.4
libmagick++4 (Ubuntu package) - update to 8:6.6.9.7-5ubuntu3.4
imagemagick-common (Ubuntu package) - addressed in versions 8:6.6.9.7-5ubuntu3.4, 8:6.7.7.10-6ubuntu3.1, 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagickcore5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.1
libmagick++5 (Ubuntu package) - update to 8:6.7.7.10-6ubuntu3.1
libmagickcore-6.q16-2 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
imagemagick-6.q16 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1
libmagick++-6.q16-5v5 (Ubuntu package) - addressed in versions 8:6.8.9.9-5ubuntu2.1, 8:6.8.9.9-7ubuntu5.1

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins