SA151: ImageMagick RCE Vulnerability (ImageTragick)

1408

04 May 2021

05 July 2017

CLOSED

HIGH

CVSS v2: 10.0

SUMMARY


Symantec Network Protection products using affected versions of ImageMagick are susceptible to the ImageTragick security vulnerability.  A remote attacker can send crafted images and execute arbitrary code on the target.

AFFECTED PRODUCTS


The following products are vulnerable:

Security Analytics
CVE Affected Version(s) Remediation
All CVEs 7.3 Not vulnerable, fixed in 7.3.1
7.2 Not available at this time
7.1 Not available at this time

ADDITIONAL PRODUCT INFORMATION


Security Analytics is only vulnerable through intercepted network traffic.

The following products are not vulnerable:
Advanced Secure Gateway
Android Mobile Agent
AuthConnector
BCAAA

Blue Coat HSM Agent for the Luna SP
CacheFlow
Client Connector
Cloud Data Protection for Salesforce
Cloud Data Protection for Salesforce Analytics
Cloud Data Protection for ServiceNow
Cloud Data Protection for Oracle CRM On Demand
Cloud Data Protection for Oracle Field Service Cloud
Cloud Data Protection for Oracle Sales Cloud
Cloud Data Protection Integration Server
Cloud Data Protection Communication Server
Cloud Data Protection Policy Builder
Content Analysis
Director

General Auth Connector Login Application

IntelligenceCenter
IntelligenceCenter Data Collector
K9
Mail Threat Defense
Malware Analysis

Management Center

Norman Shark Industrial Control System Protection
PacketShaper
PacketShaper S-Series
PolicyCenter
PolicyCenter S-Series
ProxyAV
ProxyAV ConLog and ConLogXP

ProxyClient
ProxySG
Reporter
SSL Visibility

Unified Agent
X-Series XOS

ISSUES


CVE-2016-3714
Severity / CVSSv2 High / 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
References SecurityFocus: BID 89848 / NVD: CVE-2016-3714
Impact Code execution
Description An insufficient input validation flaw in multiple ImageMagick coders allows a remote attacker to send crafted images with injected OS shell commands. The attacker can execute arbitrary code on the target system with the privileges of the ImageMagick application.

MITIGATION


Symantec's ProxySG 6.6 and 6.7 web application firewall (WAF) solution can protect network servers against some ImageTragick attack vectors. The WAF Command Injection engine, when configured to scan HTTP requests, can block HTTP POST requests containing crafted images with injected OS commands.

REFERENCES


ImageTragick - https://imagetragick.com/

REVISION


2019-01-17 IntelligenceCenter and IntelligenceCenter Data Collector are not vulnerable.  Advisory Status moved to Closed.
2017-07-05 initial public release