Bug 67273 (CVE-2005-0397)

Summary: VUL-0: CVE-2005-0397: ImageMagick format string bug
Product: [Novell Products] SUSE Security Incidents Reporter: Ludwig Nussel <lnussel>
Component: IncidentsAssignee: Marcus Meissner <meissner>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: security-team
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVE-2005-0397: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Comment 2 Marcus Meissner 2005-03-03 11:39:46 UTC 
also, there are dozens of instances of: 
 
LogMagickEvent(TraceEvent,GetMagickModule(),image_info->filename); 
 
in coders/*.c 
 
All of those are format string problems.
Comment 3 Marcus Meissner 2005-03-03 11:49:51 UTC 
(but are harmless enough to be fixed by upstream or so)
Comment 4 Sebastian Krahmer 2005-03-07 10:48:26 UTC 
Date: Wed, 2 Mar 2005 17:14:12 +0000 (GMT)
From: Mark J Cox <mjc@redhat.com>
To: Ned Ludd <solar@gentoo.org>
Cc: Thierry Carrez <koon@gentoo.org>, vendor-sec@lst.de,
    Tavis Ormandy <taviso@gentoo.org>, jrb@redhat.com
Subject: Re: [vendor-sec] imagemagick filename handling

> It's in our bugzilla and is not restricted from normal users viewing it.
> it. There are about 75 users who monitor our non restricted security
> bugs and are aware of this problem.
> http://bugs.gentoo.org/show_bug.cgi?id=83542

Okay, then use CAN-2005-0397 for this.

Mark
Comment 5 Vladimir Nadvornik 2005-03-07 17:37:15 UTC 
In ImageMagick 6.1.8 the parameter -scenes seems to be broken anyway.

> display -scenes 1-8 "test%d"
display: invalid argument `1-8' for option `-scenes'.


What should I fix for released product? Only the originaly reported bug
or all the bugs mentioned above?
Comment 6 Marcus Meissner 2005-03-08 12:56:30 UTC 
LogMagick fixes are not necessary.
Comment 7 Marcus Meissner 2005-03-08 14:04:11 UTC 
-scenes 1-8 triggers in display. 
 
if (IsGeometry(argv[i]) == MagickFalse) 
              ThrowDisplayInvalidArgumentException(option,argv[i]); 
 
which is incorrect there... I guess. 
 
 
 
 
Vladimir, just fixing this one place is enough.
Comment 8 Vladimir Nadvornik 2005-03-08 16:40:30 UTC 
packages are submitted
Comment 9 Marcus Meissner 2005-03-10 10:01:01 UTC 
swampid: 591
Comment 10 Marcus Meissner 2005-03-14 21:29:35 UTC 
emerge for testing
Comment 11 Marcus Meissner 2005-03-18 15:46:07 UTC 
updates released.
Comment 12 Thomas Biege 2009-10-13 21:09:22 UTC 
CVE-2005-0397: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)