25th Anniversary Savings | 25% Off Dedicated Servers*Shop Now
25th Anniversary Savings | 25% Off VPS Hosting* †††Shop Now
Limited Inventory: High-Performance AMD-Powered Servers Now Available.* Shop Now >
Dedicated Hosting Deals | From $99/moShop Now

Protecting Against CVE-2016-3714 (ImageMagick)

Posted on by dpepper
Reading Time: < 1 minute

Overview

A security vulnerability has been discovered in the ImageMagick software suite that can potentially allow remote code execution.

Impact

All versions of ImageMagick are affected. An updated version has been committed and should be rolling out to repositories in the near future. Until a patch is available for all systems, Liquid Web is taking steps to block the offending payloads. Additionally, a direct modification to ImageMagick’s policy file can reduce the risk of an exploit due to the vulnerability.

Resolution

A full resolution is not possible until a patch is released and applied. While that is anticipated to be available soon, in the interim, policies specifically blocking known exploits can be added directly to ImageMagick’s policy file, policy.xml. The file will be located in one of two possible directories, depending on how the software was installed:

  • /etc/ImageMagick/policy.xml
  • /usr/local/etc/ImageMagick-6/policy.xml

Once located, open policy.xml in your preferred text editor and add the following nine lines to the bottom of the file to help minimize the risks of exploit:

<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="TEXT" />
<policy domain="coder" rights="none" pattern="SHOW" />
<policy domain="coder" rights="none" pattern="WIN" />
<policy domain="coder" rights="none" pattern="PLT" />
<policy domain="path" rights="none" pattern="@*" />

Note: This post has been updated to reflect policies for four additional coders identified as potentially vulnerable, and one that prevents indirect reads entirely. ImageMagick still should be upgraded when the latest release is made available even if the policy file has been manually edited.

Managed customers who need help editing the policy file may contact Heroic Support® for assistance.
 

Avatar for dpepper

About the Author: dpepper

Latest Articles

How to Install React.js on Windows

Read Article

How to Use Disk Quotas in Dedicated Linux Servers with Plesk

Read Article

Guide on Connecting to Remote Servers Using SSH in Linux, Windows, or macOS Systems

Read Article

New User Tutorial: What is DNS?

Read Article

Difference Between AlmaLinux and Rocky Linux

Read Article