Alerta de Segurança Debian

DSA-957-2 imagemagick -- meta-limpeza de shell inexistente

Data do Alerta:
26 Jan 2006
Pacotes Afetados:
imagemagick
Vulnerável:
Sim
Referência à base de dados de segurança:
No sistema de acompanhamento de bugs do Debian: Bug 345238.
Na base de dados do BugTraq (na SecurityFocus): ID BugTraq 16093.
No dicionário CVE do Mitre: CVE-2005-4601.
Informações adicionais:

Florian Weimer descobriu que código delegado no ImageMagick é vulnerável à injeção de comando shell usando nomes de arquivos especialmente preparados. Isto permite que atacantes codifiquem comandos dentro de comandos gráficos. Com alguma interação do usuário isto pode ser explorado através do Gnus e do Thunderbird. Esta atualização filtra também o caracter '$', que foi esquecido na atualização anterior.

Para a antiga distribuição estável ("woody") este problema foi corrigido na versão 5.4.4.5-1woody8.

Para a distribuição estável ("sarge") este problema foi corrigido na versão 6.0.6.2-2.6.

Para a distribuição instável ("sid") este problema foi corrigido na versão 6.2.4.5-0.6.

Recomendamos que você atualize seus pacotes imagemagick.

Corrigido em:

Debian GNU/Linux 3.0 (woody)

Fonte:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8.dsc
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8.diff.gz
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody8_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody8_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody8_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody8_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody8_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody8_sparc.deb

Debian GNU/Linux 3.1 (sarge)

Fonte:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6.dsc
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6.diff.gz
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_amd64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_amd64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_amd64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_amd64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_amd64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.6_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.6_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.6_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.6_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.6_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.6_sparc.deb

Checksums MD5 dos arquivos listados estão disponíveis no alerta original.

Checksums MD5 dos arquivos listados estão disponíveis no alerta revisado.