CVE-2016-3715 in redhat enterprise linux desktop

Update ImageMagick and disable the URL, HTTP, HTTPS, FTP, MVG, MSL and EPHEMERAL coders (ImageTragick)

Patch or upgrade. Update ImageMagick to 6.9.3-10 / 7.0.1-1 or later (or the patched distribution package) and restrict coders in policy.xml. This stops crafted images from making the server send HTTP or FTP requests (SSRF, CVE-2016-3718) or delete arbitrary files through the ephemeral: pseudo-protocol (CVE-2016-3715); the same update fixes the rest of the ImageTragick bugs.

Applies to: ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1, and unpatched distribution packages (RHEL 6/7, Debian, Ubuntu, SUSE, openSUSE, Oracle Linux, Solaris), on any server that processes images from users.

1. Find every host and container image that has ImageMagick, including libraries that bundle it (PHP Imagick, RMagick, PythonMagick, Paperclip/CarrierWave workers): run 'convert -version' or 'magick -version' and check the package manager (rpm -q ImageMagick / dpkg -l | grep -i imagemagick).
2. RHEL 6/7: run 'yum update ImageMagick' to get the RHSA-2016:0726 packages or later. Debian 8 (jessie): run 'apt-get update && apt-get install imagemagick' to get 8:6.8.9.9-5+deb8u2 or later. SUSE/openSUSE/Ubuntu: install the vendor's ImageMagick security update. Source builds: upgrade to ImageMagick 6.9.3-10 / 7.0.1-1 or later (a current release is better).
3. Open the active policy file (/etc/ImageMagick/policy.xml, /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml; 'convert -list policy' shows which one is loaded).
4. Inside <policymap>, add these deny lines if they are missing: <policy domain="coder" rights="none" pattern="URL" />, <policy domain="coder" rights="none" pattern="HTTP" />, <policy domain="coder" rights="none" pattern="HTTPS" />, <policy domain="coder" rights="none" pattern="FTP" />, <policy domain="coder" rights="none" pattern="MVG" />, <policy domain="coder" rights="none" pattern="MSL" />, <policy domain="coder" rights="none" pattern="EPHEMERAL" />. The EPHEMERAL line is the workaround for the file deletion bug (CVE-2016-3715).
5. Check that the policy is loaded: run 'convert -list policy' and confirm the deny entries are listed.
6. Restart the services that load ImageMagick as a library (PHP-FPM, Apache with mod_php, application workers) so they pick up the new library and policy.
7. In the application, check the file's magic bytes against the allowed formats (JPEG, PNG, GIF) before passing it to ImageMagick, and do not trust the file extension.
8. Run image processing as an unprivileged user with write access only to its own working directory, so a crafted image cannot delete application or system files.
9. As a compensating control, block outbound HTTP/FTP from image-processing servers at the firewall unless they really need it.
10. Run the vulnerability scanner again and confirm it no longer reports CVE-2016-3718 or CVE-2016-3715 on the host or image.

Sources:

• https://rhn.redhat.com/errata/RHSA-2016-0726.html
• https://www.debian.org/security/2016/dsa-3580
• https://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html