其他大量网站易受 ImageMagick 漏洞影响

bindiry · May 04, 2016 · Last by adamshen replied at May 06, 2016 · 9071 hits

被 PHP、Ruby、NodeJS 和 Python 等语言支持的一个广泛使用的图像处理库 ImageMagick 发现了多个漏洞，其中一个漏洞允许远程代码执行，攻击者上传内置恶意代码的图像，网站在处理时能被利用执行攻击者选择的代码。很多社交媒体和博客网站，以及内容管理系统，都直接或间接的依靠基于 ImageMagick 的图像处理，以调整用户上传图像的大小。ImageMagick 维护者尚未释出修复漏洞的补丁，而是提供了一些权宜之计，他们建议网站管理员加入多行代码屏蔽部分可能的利用。

新闻来源：solidot

3 likes

No reference

关于 rucaptcha 库验证码显示空白的问题探究及解决

zhaopei #1 May 04, 2016

看看

1 likes

hooopo #2 May 05, 2016

/etc/ImageMagick/policy.xml 加上这个就可以了吧？还有，这文章标题翻译的...

<policymap>
  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  <policy domain="coder" rights="none" pattern="URL" />
  <policy domain="coder" rights="none" pattern="HTTPS" />
  <policy domain="coder" rights="none" pattern="MVG" />
  <policy domain="coder" rights="none" pattern="MSL" />
</policymap>

updated，最新 9 条 policy:

<policymap>
  <policy domain="coder" rights="none" pattern="EPHEMERAL" />
  <policy domain="coder" rights="none" pattern="URL" />
  <policy domain="coder" rights="none" pattern="HTTPS" />
  <policy domain="coder" rights="none" pattern="MVG" />
  <policy domain="coder" rights="none" pattern="MSL" />
  <policy domain="coder" rights="none" pattern="TEXT" />
  <policy domain="coder" rights="none" pattern="SHOW" />
  <policy domain="coder" rights="none" pattern="WIN" />
  <policy domain="coder" rights="none" pattern="PLT" />
</policymap>

via:https://imagetragick.com/

10 likes

huacnlee #3 May 05, 2016

#2 楼 @hooopo 赶紧默默的修改了

datty258 #4 May 05, 2016

https://www.imagemagick.org/discourse-server/viewtopic.php?t=29588

5 Floor has deleted

hz_qiuyuanxin #6 May 05, 2016

乌云报告：http://drops.wooyun.org/papers/15589

漏洞验证：http://www.openwall.com/lists/oss-security/2016/05/03/18

地球好危险啊

kgen #7 May 06, 2016

这里是官方申明： https://www.imagemagick.org/discourse-server/viewtopic.php?t=29588

有临时解决方案： To prevent these possible exploits, simply add

<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="TEXT" />
<policy domain="coder" rights="none" pattern="SHOW" />
<policy domain="coder" rights="none" pattern="WIN" />
<policy domain="coder" rights="none" pattern="PLT" />

to your policy.xml file. For HTTPS, you can also remove support by deleting it from the delegates.xml configuration file.