CVE-2005-4601

Vulnerability

The delegate code in ImageMagick version 6.2.4.5-0.3 fails to sanitize filenames that are passed to external commands such as the display command. By crafting a filename containing shell metacharacters, an attacker can inject arbitrary shell commands into the delegate processing pipeline. This issue affects the version 6.2.4.5-0.3 as reported in the advisory [1].

Exploitation

An attacker can remotely trigger the vulnerability by supplying a specially crafted filename (for example, ;malicious_command;.png) that, when processed by the display delegate, results in the shell interpreting and executing the injected command. No authentication or special user interaction is required beyond having the victim open the file using an affected ImageMagick utility [1].

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the user running ImageMagick. This can lead to full system compromise, data exfiltration, or installation of malicious software [1].

Mitigation

The vulnerability was addressed in Red Hat Enterprise Linux via the advisory RHSA-2006-0178 [1]. Users should update ImageMagick to a patched version. As no workaround is provided, applying the official vendor fix is strongly recommended.