National Cyber Awareness System

Vulnerability Summary for CVE-2007-4987

Overview

Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (12/05/2007)

Note: As the address of the overwritten byte is not under attacker’s control, the worst impact his bug could have is an application crash. It can not be exploited to execute arbitrary code.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 25766

Type: Patch Information; Exploit

Hyperlink:http://www.securityfocus.com/bid/25766

External Source: VUPEN

Name: ADV-2007-3245

Hyperlink:http://www.vupen.com/english/advisories/2007/3245

External Source: DEBIAN

Name: DSA-1858

Hyperlink:http://www.debian.org/security/2009/dsa-1858

External Source: MLIST

Name: [Magick-announce] 20070917 ImageMagick 6.3.5-9, important security updates

Hyperlink:http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html

External Source: SECUNIA

Name: 36260

Hyperlink:http://secunia.com/advisories/36260

External Source: IDEFENSE

Name: 20070919 Multiple Vendor ImageMagick Off-By-One Vulnerability

Hyperlink:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=595

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1743

Hyperlink:https://issues.rpath.com/browse/RPL-1743

External Source: XF

Name: imagemagick-readblogstring-bo(36739)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36739

External Source: UBUNTU

Name: USN-523-1

Hyperlink:http://www.ubuntu.com/usn/usn-523-1

External Source: SECTRACK

Name: 1018729

Hyperlink:http://www.securitytracker.com/id?1018729

External Source: BUGTRAQ

Name: 20071112 FLEA-2007-0066-1 ImageMagick

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/483572/100/0/threaded

External Source: SUSE

Name: SUSE-SR:2007:023

Hyperlink:http://www.novell.com/linux/security/advisories/2007_23_sr.html

External Source: MANDRIVA

Name: MDVSA-2008:035

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035

External Source: CONFIRM

Name: http://www.imagemagick.org/script/changelog.php

Hyperlink:http://www.imagemagick.org/script/changelog.php

External Source: GENTOO

Name: GLSA-200710-27

Hyperlink:http://security.gentoo.org/glsa/glsa-200710-27.xml

External Source: SECUNIA

Name: 28721

Hyperlink:http://secunia.com/advisories/28721

External Source: SECUNIA

Name: 27439

Hyperlink:http://secunia.com/advisories/27439

External Source: SECUNIA

Name: 27364

Hyperlink:http://secunia.com/advisories/27364

External Source: SECUNIA

Name: 27309

Hyperlink:http://secunia.com/advisories/27309

External Source: SECUNIA

Name: 27048

Hyperlink:http://secunia.com/advisories/27048

External Source: SECUNIA

Name: 26926

Hyperlink:http://secunia.com/advisories/26926

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=186030

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=186030