Denial of Service in ImageMagick via Pixel Cache Exhaustion

Executive Summary

This vulnerability in ImageMagick involves a flaw in the distributed pixel cache server where an unauthenticated attacker can repeatedly connect and exhaust available connections, causing a denial of service. The issue was fixed in version 7.1.2-32 by improving socket communication handling with new functions like dpc_receive and dpc_receive_deadline, which include timeout and error management.

Useful 0 Not Useful 0

Detection Guidance

Check if ImageMagick version is below 7.1.2-32. Monitor network connections to the distributed pixel cache server for unusual activity or connection exhaustion. Use commands like netstat -an | grep <port> to check active connections.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could cause the distributed pixel cache server to become unavailable, leading to service disruption. It requires no privileges or user interaction and can be exploited remotely with low complexity, making it a potential risk for systems using vulnerable ImageMagick versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by exhausting connections to the distributed pixel cache server. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged denial of service could indirectly affect compliance by disrupting access to critical systems handling personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ImageMagick to version 7.1.2-32 or later. Disable the distributed pixel cache server if not needed. Restrict network access to the cache server port.

Useful 0 Not Useful 0