# MA-601.052016: MyCERT Advisory - ImageMagick Vulnerability

**Date:** 06 May 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-601.052016  
**Advisory ID:** MA-601.052016

---

####
**1.0 Introduction**
ImageMagick is an open-source image processing software suite to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, JPEG-2000, GIF, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
ImageMagick has released versions 7.0.1-1 and 6.9.3-10 to address vulnerabilities in previous software versions.
**2.0 Impact**
Exploitation of this vulnerability may allow an attacker to take control of an affected system.
|  | --- | --- | CVE-2016-3714 | Insufficient shell characters filtering leads to (potentially remote) code execution | CVE-2016-3715 | File deletion. It is possible to delete files by using ImageMagick's 'ephemeral' pseudo protocol which deletes files after reading | CVE-2016-3716 | File moving. It is possible to move image files to file with any extension in any folder by using ImageMagick's 'msl' pseudo protocol. | CVE-2016-3717 | Local file read. It is possible to get content of the files from the server by using ImageMagick's 'label' pseudo protocol. |
**3.0 Affected Products**
- Products prior to ImageMagick 7.0.1-1 and 6.9.3-10
**4.0 Recommendation**
1. Verify that all image files begin with the expected magic bytes corresponding to the image file types you support before sending them to ImageMagick for processing.
2. Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in /etc/ImageMagick.
This policy.xml example will disable the coders EPHEMERAL, URL, MVG, and
MSL:
> <policymap>
> <policy domain="coder" rights="none" pattern="EPHEMERAL" />
> <policy domain="coder" rights="none" pattern="URL" />
> <policy domain="coder" rights="none" pattern="HTTPS" />
> <policy domain="coder" rights="none" pattern="MVG" />
> <policy domain="coder" rights="none" pattern="MSL" />
> </policymap>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#096a706b6c7b303030496a706b6c7b7a6c6a7c7b607d70276470) or [[email protected]](/cdn-cgi/l/email-protection#b0ddc9d3d5c2c4f0ddc9d3d5c2c49edfc2d79eddc9) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2016/05/04/ImageMagick-Vulnerability>
- <https://www.imagemagick.org/discourse-server/viewtopic.php?t=29588>
- <http://www.openwall.com/lists/oss-security/2016/05/03/18>
- <https://www.imagemagick.org/script/index.php>