Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93058
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.41 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CA+kxMuQgV0mwezA2gmqpgWgL+r+YRpm1RKyg51MJ7RUT_FXKdg@mail.gmail.com>
References: <CA+kxMuQgV0mwezA2gmqpgWgL+r+YRpm1RKyg51MJ7RUT_FXKdg@mail.gmail.com>
Date: Wed, 4 May 2016 08:21:55 +0900
Message-ID: <CAGa2bXY18De_XVPg-7Cp1wfY_4ooB2B2E5EKmoKUHv+DYMKHrg@mail.gmail.com>
To: Dan Ackroyd <danack@basereality.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] ImageMagick vulnerability
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Dan,

On Wed, May 4, 2016 at 7:33 AM, Dan Ackroyd <danack@basereality.com> wrote:
> Sorry for being off-topic, but as the maintainer for the Imagick
> extension I feel it necessary to do my best impression of Paul Revere*
> and warn people of an alleged vulnerability in the underlying
> ImageMagick library.

Not at all.
Thank you for letting us know!

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

>
> Apparently servers that use ImageMagick to process any user uploaded
> images are vulnerable to a remote code execution attack. Ways to
> mitigate this vulnerability are at: https://imagetragick.com/ which
> include:
>
> #######
>
> Verify that all image files begin with the expected "magic bytes"
> corresponding to the image file types you support before sending them
> to ImageMagick for processing.
>
> Use a policy file to disable the vulnerable ImageMagick coders. The
> global policy for ImageMagick is usually found in =E2=80=9C/etc/ImageMagi=
ck=E2=80=9D.
> The below policy.xml example will disable the coders EPHEMERAL, URL,
> MVG, and MSL.
>
> <policymap>
>   <policy domain=3D"coder" rights=3D"none" pattern=3D"EPHEMERAL" />
>   <policy domain=3D"coder" rights=3D"none" pattern=3D"URL" />
>   <policy domain=3D"coder" rights=3D"none" pattern=3D"HTTPS" />
>   <policy domain=3D"coder" rights=3D"none" pattern=3D"MVG" />
>   <policy domain=3D"coder" rights=3D"none" pattern=3D"MSL" />
> </policymap>
>
> #######
>
> I believe restarting any PHP process that would have loaded the
> Imagick extension is required to ensure this mitigation takes effect.
>
> For the record, I do not know any more details about the
> vulnerability. Nor do I believe there are any mitigation step that
> could or should be taken in the Imagick extension code.
>
> As an aside, I do recommend only processing images in a locked down
> 'background worker' process, rather directly in the web server; I'm
> not sure if that would help in for this particular vulnerability, but
> it is usually a good idea.