-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

cPanel Security Team - CVE-2016-3714 ImageMagick


Background Information

On Tuesday, May 3 2016, ImageMagick announced a vulnerability in all versions of the ImageMagick software. ImageMagick is a software
package commonly used by web services to process images.


Impact

One of the reported vulnerabilities can potentially be exploited for remote code execution (RCE).


Releases

ImageMagick has not released a fix, but plans to publish a new version of ImageMagic with the fixes soon.
cPanel normally releases all builds at once in order to limit the ability to reverse engineer fixes.However, this vulnerability is already wildly known and we have seen reports of it's use. In this instance, we plan to release builds as soon as they become available.

At this time the following builds are available:
11.56    11.56.0.13
11.54    11.54.0.23
EDGE 11.55.9999.193
CURRENT  11.56.0.13
RELEASE  11.56.0.13
STABLE   11.54.0.23


How to determine if your server is up to date

The updated RPMs provided by cPanel will contain a changelog entry with a CVE number. To view this changelog entry run the following command:
rpm -q --changelog cpanel-ImageMagick | grep CVE-2016-3714

The output should resemble below:
- - Apply workaround for CVE-2016-3714


What to do if you are not up to date

If your server is not running one of the above versions, update immediately.

To upgrade your server, navigate to WHM's Upgrade to Latest Version interface (Home >> cPanel >> Upgrade to Latest Version) and click 'Click to Upgrade'.

To upgrade cPanel from the command line run the following commands:
/scripts/upcp
/scripts/check_cpanel_rpms --fix --long-list

To verify the new cpanel-ImageMagick RPM was installed run the following command:
rpm -q --changelog cpanel-ImageMagick | grep CVE-2016-3714

The output should resemble the following:
- - Apply workaround for CVE-2016-3714


Manual mitigation

We will publish builds for 11.52 and 11.50 as soon as they become available. For 11.52 and 11.50, you can manually mitigate this vulnerability with the following instructions.

Open the following file:
/usr/local/cpanel/3rdparty/etc/ImageMagick-6/policy.xml

Update the file to match the policy example below to disable the EPHEMERAL, URL, HTTPS, MVG, and MSL coders:
<policymap>
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
</policymap>


How to mitigate the vulnerability for other ImageMagick installations

If you have a local installation of ImageMagick, we recommend that you use a policy file to disable the vulnerable ImageMagick coders. We will attempt use the WHM Autofixer to update the policy.xml file. The global policy for ImageMagick is usually found in the /etc/ImageMagick/policy.xml file. The following policy.xml example disables the coders EPHEMERAL, URL, HTTPS, MVG, and MSL:
<policymap>
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
</policymap>


CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3714
Disclosure: https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCgAGBQJXKZrAAAoJEJUhvtyr2U3f5bQP/1IKVl3i9v1StNmp7dFVc3ft
cIlFT0GHTZJ3yj6oNtpuoFyTYFuy8xfxco6o8k8/Fh8iiRhfeegcuIe18ZIK8/zS
8DK+E4o/WNBdIq5cjvVjkz9oyHP0N1GBH8r/0WKqSzx5ti/WwtBL0q+x7cNG7fHH
NUS+Im0JoDwVkOFnNA2AwpggfKZWSp3uoyGUjvOLdERzZ9rnJ7YyqH1p6K3WDppq
+jPcJCWDEdwBWd4yuQEUS86Xxk+066RKctxfNtzp4HNewbw13D5Q91mWXIL0yYL9
rni8MlMKl/+7MbvvZZ8NB/wL1QLbt0kLgeGdGYLZ9Pz7dF/QJzNVy21EbreWhWHv
bCOo4FCxq2FZmnCHAikZuwmrtodVKvIe3dvqvSXWIcQH1pxOkAi+X9gdE0a4Sl3+
737UVRNyM45g7IE0P3GfByOaH+v68ZeN5JduKW1ARKF193Vk1W+JJHdwRQ5YgfaU
YenaQ8S0twLgP18pVAvdJjIk+HlsXnBGQ26/t5k8v9CzjyfIjUk5N+WBTKUlJrXN
OSzNgjABTHDsD0gZ/I9LTa6ojWhYugsOPFhrTL2jK7YuIfe0offYIJR3RSPfeDW1
CMRyvJUnS4LSo07exmQXgCmhoMZwK12BsXWxFVH7HHuFbJdC+umMM2m9/CR1TLvP
8/cxkUsNu+LhBClajSLF
=oMlc
-----END PGP SIGNATURE-----