Bug 1117463 (CVE-2018-19492)

The changes are merged into one big patch for gnuplot 5.2 [0], for this case the changes to cairo.trm, metapost.trm and tgif.trm should be considered for this specific vulnerability.

The patch contains additional fixes for bsc#1117465, bsc#1117464 and additional issues that did not get a CVE assigned. It would be okay to apply the whole patch if that makes things easier.

Please note that there is a second commit for gnuplot 5.3, which is missing the changes for cairo.trm (should be d5020716834582b20a5e12cdd49f39ee4f9dd949)
 
[0] https://sourceforge.net/p/gnuplot/gnuplot-main/ci/e3cc539c23ceb1640395236248f0ab5a26397557/

My investigation suggests that these codestreams are affected:
- SUSE:SLE-15:Update/gnuplot
- SUSE:SLE-12:Update/gnuplot

these are not affected:
- SUSE:SLE-11:Update/gnuplot
- SUSE:SLE-10-SP3:Update

(In reply to Robert Frohl from comment #1)
> The changes are merged into one big patch for gnuplot 5.2 [0], for this case
> the changes to cairo.trm, metapost.trm and tgif.trm should be considered for
> this specific vulnerability.
> 
> The patch contains additional fixes for bsc#1117465, bsc#1117464 and
> additional issues that did not get a CVE assigned. It would be okay to apply
> the whole patch if that makes things easier.
> 
> Please note that there is a second commit for gnuplot 5.3, which is missing
> the changes for cairo.trm (should be
> d5020716834582b20a5e12cdd49f39ee4f9dd949)
>  
> [0]
> https://sourceforge.net/p/gnuplot/gnuplot-main/ci/
> e3cc539c23ceb1640395236248f0ab5a26397557/

The commits e3cc539c23ceb1640395236248f0ab5a26397557 and d5020716834582b20a5e12cdd49f39ee4f9dd949 are most identical only the first one also includes the change for cairo.trm:

--- /dev/fd/63  2018-11-28 10:50:30.866710947 +0100
+++ /dev/fd/62  2018-11-28 10:50:30.866710947 +0100
@@ -1,4 +1,4 @@
-commit d5020716834582b20a5e12cdd49f39ee4f9dd949
+commit e3cc539c23ceb1640395236248f0ab5a26397557
 Author: Ethan A Merritt <merritt@u.washington.edu>
 Date:   Mon Nov 19 11:35:25 2018 -0800
 
@@ -11,7 +11,7 @@ Date:   Mon Nov 19 11:35:25 2018 -0800
         Nils Bars
     
     Bug 2088: term.c(strlen_tex)
-    Bug 2089: metapost.trm tgif.trm (arbitrarily long font name)
+    Bug 2089: cairo.trm metapost.trm tgif.trm (arbitrarily long font name)
     Bug 2092: cgm.trm overwrites trailing '\0' in default font name
               also context.trm emf.trm
     Bug 2094: also post.trm
[...]
+diff --git term/cairo.trm term/cairo.trm
+index c3f98c695..39a206681 100644
+--- term/cairo.trm
++++ term/cairo.trm
+@@ -295,7 +295,7 @@ TERM_PUBLIC void cairotrm_options()
+                               cairo_params->fontsize = 0;
+                       } else {
+                               sep = strcspn(s,",");
+-                              if (sep > 0) {
++                              if (0 < sep && sep < MAX_ID_LEN) {
+                                       strncpy(cairo_params->fontname, s, sep);
+                                       cairo_params->fontname[sep] = '\0';
+                               }

(In reply to Robert Frohl from comment #2)
> My investigation suggests that these codestreams are affected:
> - SUSE:SLE-15:Update/gnuplot
> - SUSE:SLE-12:Update/gnuplot
> 
> these are not affected:
> - SUSE:SLE-11:Update/gnuplot
> - SUSE:SLE-10-SP3:Update

There is a problem with SLES-12 and ImageMagick

* Mon Oct 22 2018 pgajdos@suse.com
- security update (pict.c):
  * CVE-2017-14997 [bsc#1112399]
    + ImageMagick-CVE-2017-14997.patch

* Mon Oct 22 2018 pgajdos@suse.com
- fix regression in pict coder [bsc#1107609#c24]
  % ImageMagick-CVE-2018-16644.patch

* Mon Oct 22 2018 pgajdos@suse.com
- add a possibility to build with ASAN

* Fri Oct 12 2018 pgajdos@suse.com
- security update (bmp.c)
  * CVE-2018-18024 [bsc#1111069]
  * ImageMagick-CVE-2018-18024.patch

* Thu Oct 11 2018 pgajdos@suse.com
- security update (pcx.c)
  * CVE-2018-18016 [bsc#1111072]
    % ImageMagick-CVE-2017-13058.patch renamed to
    ImageMagick-CVE-2017-13058,CVE-2018-18016.patch

* Thu Oct 11 2018 pgajdos@suse.com
- security update (sgi.c)
  * CVE-2018-17965 [bsc#1110747]
    + ImageMagick-CVE-2018-17965.patch

* Thu Oct 11 2018 pgajdos@suse.com
- security update (dib.c and bmp.c)
  * CVE-2018-12600 [bsc#1098545]
    + ImageMagick-CVE-2018-12600.patch
  * CVE-2018-12599 [bsc#1098546]
    + ImageMagick-CVE-2018-12599.patch

* Wed Oct 10 2018 pgajdos@suse.com
- security update (pdb.c):
  * CVE-2018-17966 [bsc#1110746]
    + ImageMagick-CVE-2018-17966.patch

... this breaks build of gnuplot:

[  202s] convert: not authorized `zzgnuplot.ps' @ error/constitute.c/ReadImage/464.
[  202s] convert: no images defined `gnuplot11x.png' @ error/convert.c/ConvertImageCommand/3149.
[  202s] ----------------------------
[  202s] t4ht.c (2012-07-25-19:28 kpathsea)
[  202s] t4ht -f/gnuplot 
[  202s] (/usr/share/texmf/tex4ht/base/unix/tex4ht.env)
[  202s] Entering gnuplot.lg
[  202s] System call: dvips -E -Ppdf -mode ibmvga -D 110 -f gnuplot.idv -pp 2  > zzgnuplot.ps
[  202s] System return: 0
[  202s] System call: convert -trim +repage -density 110x110 -transparent '#FFFFFF' zzgnuplot.ps gnuplot0x.png
[  202s] --- Warning --- System return: 256
[  202s] System call: dvips -E -Ppdf -mode ibmvga -D 110 -f gnuplot.idv -pp 4  > zzgnuplot.ps
[  202s] System return: 0

It seems not to be possible to overwrite /etc/ImageMagick-6/policy.xml with a $HOME/.magic/policy.xml ... this breaks build here.  IMHO this is a nogo

Werner, you seem to be little bit impatient. The relevant pointer for this issue is:

-------------------------------------------------------------------
Wed Aug 22 10:04:54 UTC 2018 - pgajdos@suse.com

- disable PS, PS2, PS3, XPS and PDF coders in default policy.xml
  [bsc#1105592]

(In reply to Dr. Werner Fink from comment #5)
> It seems not to be possible to overwrite /etc/ImageMagick-6/policy.xml with
> a $HOME/.magic/policy.xml ... this breaks build here.  IMHO this is a nogo

Yes, I still have not found a solution for SLE12. It is possible in newer ImageMagick versions as can be seen from following example:

https://build.opensuse.org/request/show/639367

But for ImageMagick-6.8.8-1 even following does not work as I would expect:

  <policy domain="coder" rights="write" pattern="PS" />
  <policy domain="coder" rights="read" pattern="PS" />

(in one file) will disable reading/writing actually. Whether this is nogo or enabling PS coders is nogo you should ask rather security team ;).

(In reply to Petr Gajdos from comment #6)
> Werner, you seem to be little bit impatient. The relevant pointer for this
> issue is:
> 
> -------------------------------------------------------------------
> Wed Aug 22 10:04:54 UTC 2018 - pgajdos@suse.com
> 
> - disable PS, PS2, PS3, XPS and PDF coders in default policy.xml
>   [bsc#1105592]
> 
> (In reply to Dr. Werner Fink from comment #5)
> > It seems not to be possible to overwrite /etc/ImageMagick-6/policy.xml with
> > a $HOME/.magic/policy.xml ... this breaks build here.  IMHO this is a nogo
> 
> Yes, I still have not found a solution for SLE12. It is possible in newer
> ImageMagick versions as can be seen from following example:
> 
> https://rudin.suse.de:8894/request/show/639367

This seems to work if I use ~/.magick/policy.xml instead of ~/.config/ImageMagick/policy.xml

Yep, perfect, thanks!

(In reply to Dr. Werner Fink from comment #8)
> Yep, perfect, thanks!

Hmmm ... it had work with my changed /etc/ImageMagick-6/policy.xml plus the new ~/.magick/policy.xml but with the default /etc/ImageMagick-6/policy.xml it still does not work ... trying again

Created attachment 791173 [details]
/etc/ImageMagick-6/policy.xml modified

This is the policy I'm using with osc build --no-init in combination with the policy below ~/.magick/

OK found the problem ... the /etc/ImageMagick-6/policy.xml wins over ~/.magick/policy.xml  that is is you are using the modify system policy in combination with the ~/.magick/policy.xml it works ... also simply copy the ~/.magick/policy.xml to the system wide policy works.  But only the modify system policy does not.

convert -verbose -trim +repage -density 110x110 -transparent '#FFFFFF'  zzgnuplot.ps gnuplot0x.png 
"gs" -q -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 "-sDEVICE=pngalpha" -dTextAlphaBits=4 -dGraphicsAlphaBits=4 "-r110x110" -g11x12  "-sOutputFile=/tmp/magick-224662xC-k0xfGA7f%d" "-f/tmp/magick-224665uRIUBN1cgYr" "-f/tmp/magick-22466RzTM38342bPD"

... there has to be the authorization for /tmp/ as well I guess

For me this looks as the ~/.magick/policy.xml can extend the system wide policy but not overwrite

(In reply to Dr. Werner Fink from comment #13)
> For me this looks as the ~/.magick/policy.xml can extend the system wide
> policy but not overwrite

Yep, to me it looks like that as well; I plan to look at it today.

With 6.9.9-14, the system policy can be overridden by .magick/policy.xml.

MAGICK_CONFIGURE_PATH does not help either, even if custom policy.xml is read first:

$ MAGICK_CONFIGURE_PATH=/home/abuild strace convert out.ps out.png 2>&1 | grep 'not authorized\|policy.xml'
open("/home/abuild/policy.xml", O_RDONLY) = 3
open("/usr/share/ImageMagick-6/policy.xml", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib64/ImageMagick-6.8.8//config-Q16/policy.xml", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/etc/ImageMagick-6/policy.xml", O_RDONLY) = 3
open("/usr/share/doc/packages/ImageMagick/policy.xml", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/home/abuild/.magick/policy.xml", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "abuild: not authorized `out.ps' "..., 66abuild: not authorized `out.ps' @ error/constitute.c/ReadImage/464) = 66
$

(In reply to Petr Gajdos from comment #15)
> With 6.9.9-14, the system policy can be overridden by .magick/policy.xml.

This appears to be a consequence of
https://github.com/ImageMagick/ImageMagick6/commit/af8ab904f1da20ed9f4738cdc737c0cdeed4ba80

After extracting the relevant part of the patch the policy overriding appears to work well. I also tried to enable something with system policy and disable it again in user policy.

Anyway, second pair of eyes would be appreciated.

Do we want to change the policy behavior described in comment 17 also for SLE12?

Another solution could perhaps be to create two conflicting packages providing the same file /etc/ImageMagick-6/policy.xml and the same symbol, e. g. ImageMagick-config and ImageMagick-config-insecure. Main package would then require the symbol. BuildRequired by gnuplot (and others) could be ImageMagick-config-insecure. Either ImageMagick-config-insecure would not be shipped at all or ImageMagick-config would be recommended by main package. Untested, and not sure I see all difficulties.

I have now submitted solution described in comment 17. security-team@, Let me know if you want try something else.

The ImageMagick policy patch looks OK to me as far as I understand it.

good for us -> needinfo provided

(In reply to Marcus Meissner from comment #22)
> good for us -> needinfo provided

Hmmm ...where will the new version of ImageMagick be active in SUSE_SLE-12_Update

we will push an adjusted imagemagick to qa that can override policies via $HOME/.magick/policy.xml

SUSE-SU-2018:4023-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (moderate)
Bug References: 1057246,1113064,1117463
CVE References: CVE-2018-18544
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Server 12-SP4 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Desktop 12-SP4 (src):    ImageMagick-6.8.8.1-71.93.2
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.93.2

openSUSE-SU-2018:4054-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (moderate)
Bug References: 1057246,1113064,1117463
CVE References: CVE-2018-18544
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-79.1

SUSE-SU-2019:0904-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1117463,1117464,1117465
CVE References: CVE-2018-19490,CVE-2018-19491,CVE-2018-19492
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    gnuplot-5.2.2-3.3.29

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.

openSUSE-SU-2019:1216-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1117463,1117464,1117465
CVE References: CVE-2018-19490,CVE-2018-19491,CVE-2018-19492
Sources used:
openSUSE Leap 15.0 (src):    gnuplot-5.2.2-lp150.3.3.1

released

SUSE-SU-2020:14388-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1044638,1117463,1117464,1117465,375175
CVE References: CVE-2017-9670,CVE-2018-19490,CVE-2018-19491,CVE-2018-19492
Sources used:
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    gnuplot-4.2.3-7.3.22

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2020:1660-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1044638,1117463,1117464,1117465
CVE References: CVE-2017-9670,CVE-2018-19490,CVE-2018-19491,CVE-2018-19492
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    gnuplot-4.6.5-3.3.74
SUSE Linux Enterprise Server 12-SP4 (src):    gnuplot-4.6.5-3.3.74

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.