Bypass PSD List-Length Policy in ImageMagick

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Before versions 6.9.13-47 and 7.1.2-22, there was a missing check in the PSD image decoder that allowed an attacker to bypass the list-length resource policy when decoding a PSD image. Although other security limits would still apply, this missing check could potentially allow resource usage beyond intended limits. The issue has been fixed in the mentioned versions.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to bypass the list-length resource policy when decoding PSD images in vulnerable versions of ImageMagick. This could lead to increased resource consumption, potentially causing denial of service or performance degradation. However, other security limits remain in place, which may mitigate some risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-47 or later, or 7.1.2-22 or later, where the issue has been patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in ImageMagick's PSD decoder allows bypassing the list-length resource policy, potentially leading to resource exhaustion and impacting availability.

Since the vulnerability does not affect confidentiality or integrity, its direct impact on compliance with standards like GDPR or HIPAA—which emphasize data protection and privacy—is limited.

However, the availability impact could indirectly affect compliance if it leads to denial of service or disruption of systems that handle regulated data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a missing check in the PSD decoder of ImageMagick that allows bypassing the list-length resource policy when decoding PSD images. Detection would involve identifying attempts to process PSD images with vulnerable versions of ImageMagick (prior to 6.9.13-47 and 7.1.2-22).

To detect exploitation attempts or verify if your system is vulnerable, you can check the installed ImageMagick version using the following command:

• magick -version

If the version is older than 6.9.13-47 or 7.1.2-22, your system is vulnerable.

To detect potential exploitation attempts, you can monitor logs or network traffic for PSD image files being processed or transferred. Additionally, you can test the PSD decoder by attempting to process specially crafted PSD images that could trigger the policy bypass.

No specific detection commands or signatures are provided in the available resources.

Useful 0 Not Useful 0