January 2005

ID: 00040
Ref: 36/2005
Date: 18 January 2005:15:03:06
Version: 1

---

Title: Two iDEFENSE Security Advisories: 1. AWStats Remote Command Execution Vulnerability 2. Multiple Vendor ImageMagick .psd Image File Decode Heap Overflow Vulnerability
Abstract:
Vendors affected: iDEFENSE
Operating systems affected: iDEFENSE
Applications affected: iDEFENSE

---

Title
=====

Two iDEFENSE Security Advisories:

1. AWStats Remote Command Execution Vulnerability

2. Multiple Vendor ImageMagick .psd Image File Decode Heap Overflow
Vulnerability


Detail
======

1. Remote exploitation of an input validation vulnerability in AWStats
allows attackers to execute arbitrary commands under the privileges
of the web server.

2. Remote exploitation of a buffer overflow vulnerability in The
ImageMagick's Project's ImageMagick PSD image-decoding module could
allow an attacker to execute arbitrary code.




1.



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================

ESB-2005.0049 -- iDEFENSE Security Advisory 01.17.05
AWStats Remote Command Execution Vulnerability
18 January 2005

===========================================================================



Product: AWStats
Publisher: iDEFENSE
Operating System: BSD variants
Linux variants
UNIX variants
Windows
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated

Original Bulletin: http://www.idefense.com/application/poi/display?id=185

- - --------------------------BEGIN INCLUDED TEXT--------------------

AWStats Remote Command Execution Vulnerability

iDEFENSE Security Advisory 01.17.05
www.idefense.com/application/poi/display?id=185&type=vulnerabilities
January 17, 2005

I. BACKGROUND

AWStats is a free tool that generates advanced web, ftp or mail server
statistics, graphically. More information about AWStats is available
from:

http://awstats.sourceforge.net

II. DESCRIPTION

Remote exploitation of an input validation vulnerability in AWStats
allows attackers to execute arbitrary commands under the privileges
of the web server.

The problem specifically exists when the application is running as a
CGI script on a web server. The "configdir" parameter contains
unfiltered user-supplied data that is utilized in a call to the Perl
routine open() as can be seen here on line 1082 of awstats.pl:

if (open(CONFIG,"$searchdir$PROG.$SiteConfig.conf"))

The "searchdir" variables hold the value of the parameter provided
by the attacker from "configdir." An attacker can cause arbitrary
commands to be executed by prefixing them with the "|" character.

III. ANALYSIS

Successful exploitation allows remote attackers to execute arbitrary
commands under the privileges of the web server. This can lead to
further compromise as it provides remote attackers with local access.

IV. DETECTION

iDEFENSE has confirmed that AWStats version 6.1 is vulnerable. It is
suspected that earlier versions are also vulnerable.

V. WORKAROUND

Add a filter around the "configdir" parameter by replacing the following
line:

if ($QueryString =~ /configdir=([^&]+)/i)
{
$DirConfig=&DecodeEncodedString("$1");
}

With:

if ($QueryString =~ /configdir=([^&]+)/i)
{
$DirConfig=&DecodeEncodedString("$1");
$DirConfig=~tr/a-z0-9_\-\/\./a-z0-9_\-\/\./cd;
}

VI. VENDOR RESPONSE

This vulnerability is addressed in AWStats 6.3, available for download
at:

http://awstats.sourceforge.net/#DOWNLOAD

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

10/21/2004 Initial vendor notification
01/02/2005 Initial vendor response
01/17/2005 Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDEFENSE. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please email
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information.
Use of the information constitutes acceptance for use in an AS IS
condition. There are no warranties with regard to this information.
Neither the author nor the publisher accepts any liability for any
direct, indirect, or consequential loss or damage arising from use of,
or reliance on, this information.

- - --------------------------END INCLUDED TEXT--------------------


iQCVAwUBQexTNyh9+71yA2DNAQIcCAP/VrkhIK+MDkY+8yw7H3jybI+C0SoV+xHK
nbQsBPZV8nHh44FUVu6oTpmzunVNVlBJgPj4m5Vwraa8cE31oIB8U4CoNlsi/gh+
Y0ihfe+rZ+cPtaN0MH479GmfbJtHB5Ko8OdGomiq2O+hiQTlzF1rxuh/GxblnrN7
hP795M9Y0kA=
=yVeY
- -----END PGP SIGNATURE-----


2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================


ESB-2005.0048 -- iDEFENSE Security Advisory 01.17.05
Multiple Vendor ImageMagick .psd Image File Decode Heap
Overflow Vulnerability
18 January 2005

===========================================================================



Product: ImageMagick 6.1.7 and prior
Publisher: iDEFENSE
Operating System: BSD variants
Linux variants
UNIX variants
Mac OS
Mac OS X
Windows
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CAN-2005-0005

Original Bulletin: http://www.idefense.com/application/poi/display?id=184

- - --------------------------BEGIN INCLUDED TEXT--------------------

Multiple Vendor ImageMagick .psd Image File Decode Heap Overflow Vulnerability

iDEFENSE Security Advisory 01.17.05
www.idefense.com/application/poi/display?id=184&type=vulnerabilities
January 17, 2005

I. BACKGROUND

ImageMagick provides a variety of graphics image-handling libraries and
capabilities. These libraries are widely used and are shipped by default

on most Unix and Linux distributions. These libraries are commonly
installed by default on computers where any other graphical image
viewer or X Desktop environment is installed (such as Gnome or KDE).

More information is available at the following site:

http://www.imagemagick.org

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in The
ImageMagick's Project's ImageMagick PSD image-decoding module could
allow an attacker to execute arbitrary code.

A heap overflow exists within ImageMagick, specifically in the decoding
of Photoshop Document (PSD) files. The vulnerable code follows:

ImageMagick-6.1.0/coders/psd.c

for (j=0; j < (long) layer_info[i].channels; j++)
{
layer_info[i].channel_info[j].type=(short)ReadBlobMSBShort(image);
layer_info[i].channel_info[j].size=ReadBlobMSBLong(image);
[...]
}

The array channel_info is only 24 elements large, and the loop variable,

"j", is bounded by a user-supplied value from the image file, thus
allowing a heap overflow to occur when more than 24 layers are
specified. If heap structures are overflowed in a controlled way,
execution of arbitrary code is possible.

III. ANALYSIS

Exploitation may allow attackers to run arbitrary code on a victim's
computer if the victim opens a specially formatted image. Such images
could be delivered by e-mail or HTML, in some cases, and would likely
not raise suspicion on the victim's part. Exploitation is also possible
when a web-based application uses ImageMagick to process user-uploaded
image files.

IV. DETECTION

iDEFENSE has confirmed this vulnerability in ImageMagick 6.1.0 and
ImageMagick 6.1.7. Earlier versions are also suspected vulnerable.

The following vendors may include vulnerable ImageMagick packages:

The Debian Project
MandrakeSoft
Red Hat, Inc.

V. WORKAROUND

Do not open files from untrusted sources. Do not allow untrusted sources

to process images using your web application.

VI. VENDOR RESPONSE

This vulnerability is addressed in ImageMagick 6.1.8-8, available for download at:

http://www.imagemagick.org/www/download.html

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the names
CAN-2005-0005 to these issues. This is a candidate for inclusion in the CVE
list (http://cve.mitre.org), which standardizes names for security problems.

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been
assigned yet.

VIII. DISCLOSURE TIMELINE

12/21/2004 Initial vendor notification
01/14/2004 Initial vendor response
01/17/2005 Public disclosure

IX. CREDIT

Andrei Nigmatulin is credited with this discovery.

Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDEFENSE. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please email
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information.
Use of the information constitutes acceptance for use in an AS IS
condition. There are no warranties with regard to this information.
Neither the author nor the publisher accepts any liability for any
direct, indirect, or consequential loss or damage arising from use
of, or reliance on, this information.

- - --------------------------END INCLUDED TEXT--------------------



iQCVAwUBQexPWyh9+71yA2DNAQJwIQP+Kvwd1jyp5+EIBaHswSy4D2FT/8MjytqB
6JZTRCdo5PvxYcQ07MiZwID1dnvhoxjznEGXB6M6VqTIh4oXLO5tFL/jkR1AoJEP
51J0OKrp8GWy2DuZd7BOvrJJxGEV6QlE37m1qEr98R121/EeKbhoy5K2d85Z2Xx/
J4doYUSxOGE=
=lR9x
- -----END PGP SIGNATURE-----