CVE-2020-13902
📋 TL;DR
This vulnerability in ImageMagick allows attackers to read heap memory beyond allocated buffers when processing specially crafted TIFF images. It affects systems using vulnerable ImageMagick versions to process untrusted image files. The heap buffer over-read could leak sensitive information or potentially lead to further exploitation.
💻 Affected Systems
- ImageMagick
📦 What is this software?
Imagemagick by Imagemagick
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leading to memory content leakage, potentially exposing sensitive data like passwords, keys, or other process memory. Could be chained with other vulnerabilities for remote code execution.
Likely Case
Application crashes (denial of service) when processing malicious TIFF files. Information disclosure of adjacent heap memory.
If Mitigated
Minimal impact if proper input validation and sandboxing are in place, with only controlled crashes possible.
🎯 Exploit Status
Exploitation requires crafting a malicious TIFF file that triggers the buffer over-read. Public proof-of-concept exists in the OSS-Fuzz bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ImageMagick 7.0.10-18 and later
Vendor Advisory: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7v27-29w3-3q3h
Restart Required: No
Instructions:
1. Check current ImageMagick version with 'convert --version'. 2. Update to version 7.0.10-18 or later using your package manager. 3. For source installations: download latest source from imagemagick.org, compile and install.
🔧 Temporary Workarounds
Disable TIFF format support
linuxRemove or disable TIFF coder module to prevent processing of TIFF images
mv /usr/lib/ImageMagick-7.0.10/modules-Q16HDRI/coders/tiff.* /tmp/
Alternatively edit policy.xml to disable TIFF
Implement input validation
allReject or sanitize TIFF files from untrusted sources before processing
🧯 If You Can't Patch
- Implement strict file type validation to reject TIFF files from untrusted sources
- Run ImageMagick in a sandboxed environment with limited memory access
🔍 How to Verify
Check if Vulnerable:
Run 'convert --version' and check if version is between 7.0.9-27 and 7.0.10-17 inclusiveCheck Version:
convert --version | head -1Verify Fix Applied:
After update, verify version is 7.0.10-18 or later with 'convert --version'📡 Detection & Monitoring
Log Indicators:
- ImageMagick process crashes when processing TIFF files
- Memory access violation errors in system logs
Network Indicators:
- Unusual TIFF file uploads to web applications
- Multiple failed image processing attempts
SIEM Query:
process_name:"convert" AND (event_type:"crash" OR error_message:"segmentation fault") AND file_extension:".tif" OR ".tiff"