CVE-2016-10145
📋 TL;DR
CVE-2016-10145 is an off-by-one buffer overflow vulnerability in ImageMagick's WPG image format decoder. This allows remote attackers to execute arbitrary code or cause denial of service by tricking a user or application into processing a specially crafted WPG image file. Any system using vulnerable versions of ImageMagick to process untrusted image files is affected.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the ImageMagick process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
If proper input validation and sandboxing are in place, impact may be limited to denial of service.
🎯 Exploit Status
Exploitation requires the victim to process a malicious WPG file. Public proof-of-concept code demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ImageMagick 6.9.7-4 and 7.0.4-4
Vendor Advisory: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483
Restart Required: No
Instructions:
1. Update ImageMagick using your system's package manager. 2. For Debian/Ubuntu: sudo apt-get update && sudo apt-get install imagemagick. 3. For source installations: Download latest version from imagemagick.org and recompile.
🔧 Temporary Workarounds
Disable WPG format support
linuxRemove or disable the WPG coder module to prevent processing of WPG files.
sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml.backup
echo '<policymap><policy domain="coder" rights="none" pattern="WPG" /></policymap>' | sudo tee /etc/ImageMagick-6/policy.xml
🧯 If You Can't Patch
- Implement strict input validation to reject WPG files at application level
- Run ImageMagick in a sandboxed/containerized environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check ImageMagick version: convert --version | head -1. If version is below 6.9.7-4 or 7.0.4-4, system is vulnerable.Check Version:
convert --version | head -1Verify Fix Applied:
After update, verify version is 6.9.7-4 or higher (6.x) or 7.0.4-4 or higher (7.x).📡 Detection & Monitoring
Log Indicators:
- ImageMagick process crashes with segmentation faults
- Error messages related to WPG file processing
Network Indicators:
- Unusual WPG file uploads to web applications
- Image processing requests for WPG files
SIEM Query:
process_name:"convert" AND (event_type:crash OR error_message:"WPG")🔗 References
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95749
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483
- https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9
- https://security.gentoo.org/glsa/201702-09
- http://www.debian.org/security/2017/dsa-3799
- http://www.openwall.com/lists/oss-security/2017/01/16/6
- http://www.openwall.com/lists/oss-security/2017/01/17/5
- http://www.securityfocus.com/bid/95749
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483
- https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9
- https://security.gentoo.org/glsa/201702-09
