Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93057
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain basereality.com from 209.85.161.177 cause and error)
MIME-Version: 1.0
Date: Tue, 3 May 2016 23:33:44 +0100
Message-ID: <CA+kxMuQgV0mwezA2gmqpgWgL+r+YRpm1RKyg51MJ7RUT_FXKdg@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: ImageMagick vulnerability
From: danack@basereality.com (Dan Ackroyd)

Hello,

Sorry for being off-topic, but as the maintainer for the Imagick
extension I feel it necessary to do my best impression of Paul Revere*
and warn people of an alleged vulnerability in the underlying
ImageMagick library.

Apparently servers that use ImageMagick to process any user uploaded
images are vulnerable to a remote code execution attack. Ways to
mitigate this vulnerability are at: https://imagetragick.com/ which
include:

#######

Verify that all image files begin with the expected "magic bytes"
corresponding to the image file types you support before sending them
to ImageMagick for processing.

Use a policy file to disable the vulnerable ImageMagick coders. The
global policy for ImageMagick is usually found in =E2=80=9C/etc/ImageMagick=
=E2=80=9D.
The below policy.xml example will disable the coders EPHEMERAL, URL,
MVG, and MSL.

<policymap>
  <policy domain=3D"coder" rights=3D"none" pattern=3D"EPHEMERAL" />
  <policy domain=3D"coder" rights=3D"none" pattern=3D"URL" />
  <policy domain=3D"coder" rights=3D"none" pattern=3D"HTTPS" />
  <policy domain=3D"coder" rights=3D"none" pattern=3D"MVG" />
  <policy domain=3D"coder" rights=3D"none" pattern=3D"MSL" />
</policymap>

#######

I believe restarting any PHP process that would have loaded the
Imagick extension is required to ensure this mitigation takes effect.

For the record, I do not know any more details about the
vulnerability. Nor do I believe there are any mitigation step that
could or should be taken in the Imagick extension code.

As an aside, I do recommend only processing images in a locked down
'background worker' process, rather directly in the web server; I'm
not sure if that would help in for this particular vulnerability, but
it is usually a good idea.

cheers
Dan
Ack

* https://twitter.com/MrDanack/status/727623821860216832