CVE-2018-9133

Vulnerability

ImageMagick version 7.0.7-26 Q16 suffers from excessive iteration in the DecodeLabImage and EncodeLabImage functions in coders/tiff.c. The functions assume legitimate values for image->rows and image->columns, but a crafted TIFF file can set these to large values, causing an almost infinite loop that leads to a hang lasting tens of minutes [2]. The issue is triggered when ImageMagick reads a specially crafted TIFF file.

Exploitation

An attacker needs to craft a small TIFF file (e.g., 108 bytes) with manipulated image dimensions. The attacker can deliver this file to a user or automated system that processes images with ImageMagick. When the file is opened (e.g., via mogrify), the application enters the DecodeLabImage or EncodeLabImage loop and becomes unresponsive for an extended period [2]. No special privileges are required; the attacker only needs to trick the target into processing the malicious file.

Impact

Successful exploitation results in a denial of service (DoS). The ImageMagick process hangs for tens of minutes, consuming CPU resources and preventing normal operation. The impact is limited to availability; confidentiality and integrity are not affected. The PoC file is only 108 bytes, making it easy to distribute [2].

Mitigation

ImageMagick has addressed the issue in later versions. Ubuntu users can update to the fixed packages as provided in USN-3681-1 [1]. The recommended mitigation is to apply the latest security updates for ImageMagick. Until patched, avoid processing untrusted TIFF files, or consider using alternative image processing libraries.