ImageMagick 7.0.8-26 Q16 Cineon Parser coders/cin.c ReadCINImage resource consumption

Summaryinfo

A vulnerability was found in ImageMagick 7.0.8-26 Q16. It has been classified as problematic. Impacted is the function ReadCINImage of the file coders/cin.c of the component Cineon Parser. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2019-11470. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ImageMagick 7.0.8-26 Q16 (Image Processing Software). This issue affects the function ReadCINImage of the file coders/cin.c of the component Cineon Parser. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.

The bug was discovered 04/14/2019. The weakness was published 04/23/2019 (Website). The advisory is shared at lists.fedoraproject.org. The identification of this vulnerability is CVE-2019-11470 since 04/23/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-133987, VDB-134524 and VDB-134525. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Image Processing Software

Name

• ImageMagick

Version

• 7.0.8-26 Q16

License

• open-source

Website

• Product: https://www.imagemagick.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion