1269795 - [BMO] ImageMagick Is On Fire (CVE-2016-3714)

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect, P1)

Description

[Dylan Hardison [:dylan] (he/him)]

+++ This bug was initially created as a clone of Bug #1269793 +++

https://medium.com/@rhuber/imagemagick-is-on-fire-cve-2016-3714-379faf762247#.kqh5svaq0

> If you use ImageMagick or an affected library, we recommend you mitigate the
> known vulnerabilities by doing at least one these two things (but preferably
> both!):

> Verify that all image files begin with the expected “magic bytes”
> corresponding to the image file types you support before sending them to
> ImageMagick for processing. (see FAQ for more info) Use a policy file to
> disable the vulnerable ImageMagick coders. The global policy for ImageMagick
> is usually found in “/etc/ImageMagick”. This policy.xml example will disable
> the coders EPHEMERAL, URL, MVG, and MSL.

> https://gist.githubusercontent.com/rawdigits/d73312d21c8584590783a5e07e124723/raw/d3232a3958d8a26adcce53dfa2413b42623ca4b8/policy.xml

Comment 1

[Dylan Hardison [:dylan] (he/him)]

woops, I meant to add:

fubar: Can we apply the policy file/config change to all the webheads, including in AWS? I'm keen to prevent remote code executions in either environment.

Comment 2

[Kendall Libby [:fubar] (he/him)]

(In reply to Dylan William Hardison [:dylan] from comment #0)
> 
> The global policy for ImageMagick is usually found in “/etc/ImageMagick”.

lol, usually. do we have a way to test this vuln manually? I'd like to be able to make sure that it's disabled rather than assuming I've put it in the right place.

Comment 3

[Kendall Libby [:fubar] (he/him)]

also, /cc :gozer for his input on AWS

Comment 4

[Dylan Hardison [:dylan] (he/him)]

Attachment: 1269795_1.patch

Comment 5

[David Lawrence [:dkl]]

Comment on attachment 8748348 [details] [diff] [review]
1269795_1.patch

Review of attachment 8748348 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 6

[Frédéric Buclin]

Instead of deleting the whole extension, you could simply put extensions/BmpConvert/disabled to disable it. This way, when your ImageMagick module is updated, you can re-enable the extension.

Comment 7

[Dylan Hardison [:dylan] (he/him)]

I'm going to re-add the functionality using something other than image magick.

Comment 8

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   3484d75..5a9a4e8  master -> master

Comment 9

[David Lawrence [:dkl]]

This has been pushed to production.

Comment 10

[Kendall Libby [:fubar] (he/him)]

(In reply to Dylan William Hardison [:dylan] from comment #7)
> I'm going to re-add the functionality using something other than image
> magick.

does this mean we can remove the imagemagick packages altogether?

Comment 11

[Dylan Hardison [:dylan] (he/him)]

(In reply to Kendall Libby [:fubar] from comment #10)
> (In reply to Dylan William Hardison [:dylan] from comment #7)
> > I'm going to re-add the functionality using something other than image
> > magick.
> 
> does this mean we can remove the imagemagick packages altogether?

Yes[1] we should kill them with fire.

[1] a quick check to make sure nothing else is using it should be done.

Comment 12

[Kendall Libby [:fubar] (he/him)]

It was installed as part of the bugzilla puppet module, so only BMO would have been using it. I've removed it across the board.