CVE-2016-3714
ImageMagick Improper Input Validation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
7Exploited in Wild
YesDecision
Descriptions
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Los codificadores (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN y (8) PLT en ImageMagick en versiones anteriores a 6.9.3-10 y 7.x en versiones anteriores a 7.0.1-1 permiten a atacantes remotos ejecutar código arbitrario a través de metacaracteres shell en una imagen manipulada, también conocido como "ImageTragick".
It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.
ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.
CVSS Scores
SSVC
- Decision:Act
Timeline
- 2016-03-30 CVE Reserved
- 2016-05-04 First Exploit
- 2016-05-05 CVE Published
- 2024-09-09 CVE Updated
- 2024-09-09 Exploited in Wild
- 2024-09-30 KEV Due Date
- 2024-10-18 EPSS Updated
CWE
- CWE-20: Improper Input Validation
CAPEC
References (36)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/152364/ImageTragick-ImageMagick-Proof-Of-Concepts.html | Third Party Advisory |
|
| http://www.openwall.com/lists/oss-security/2016/05/03/13 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/05/03/18 | Mailing List |
|
| http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html | Third Party Advisory |
|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html | Third Party Advisory |
|
| http://www.rapid7.com/db/modules/exploit/unix/fileformat/imagemagick_delegate | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/538378/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/89848 | Third Party Advisory | |
| http://www.securitytracker.com/id/1035742 | Third Party Advisory | |
| https://access.redhat.com/security/vulnerabilities/2296071 | Third Party Advisory | |
| https://www.kb.cert.org/vuls/id/250519 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/39767 | 2024-09-09 | |
| https://www.exploit-db.com/exploits/39791 | 2024-09-09 | |
| https://github.com/Hood3dRob1n/CVE-2016-3714 | 2016-05-07 | |
| https://github.com/jpeanut/ImageTragick-CVE-2016-3714-RShell | 2016-05-29 | |
| https://github.com/chusiang/CVE-2016-3714.ansible.role | 2016-05-11 | |
| https://github.com/JoshMorrison99/CVE-2016-3714 | 2022-12-02 | |
| https://github.com/tommiionfire/CVE-2016-3714 | 2016-05-04 |
| URL | Date | SRC |
|---|---|---|
| http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog | 2023-02-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | <= 6.9.3-9 Search vendor "Imagemagick" for product "Imagemagick" and version " <= 6.9.3-9" | - |
Affected
| ||||||
| Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | 7.0.0-0 Search vendor "Imagemagick" for product "Imagemagick" and version "7.0.0-0" | - |
Affected
| ||||||
| Imagemagick Search vendor "Imagemagick" | Imagemagick Search vendor "Imagemagick" for product "Imagemagick" | 7.0.1-0 Search vendor "Imagemagick" for product "Imagemagick" and version "7.0.1-0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 15.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 42.1 Search vendor "Opensuse" for product "Leap" and version "42.1" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2" | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Suse Linux Enterprise Server Search vendor "Suse" for product "Suse Linux Enterprise Server" | 12 Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "12" | - |
Affected
| ||||||