ImageTragick
ImageMagick Is On Fire―CVE-2016-3714
TL;DR
There are multiple vulnerabilities in ImageMagick, a package commonly used by web services to process images.
One of the vulnerabilities can lead to remote code execution (RCE) if you process user submitted images. The exploit for this vulnerability is being used in the wild.
A number of image processing plugins depend on the ImageMagick library, including, but not limited to, PHP’s imagick, Ruby’s rmagick and paperclip, and nodejs’s imagemagick.
If you use ImageMagick or an affected library, we recommend you mitigate the known vulnerabilities by doing at least one these two things (but preferably both!):
Verify that all image files begin with the expected "magic bytes" corresponding to the image file types you support before sending them to ImageMagick for processing. (see FAQ for more info)
Use a policy file to disable the vulnerable ImageMagick coders. The global policy for ImageMagick is usually found in “/etc/ImageMagick”. The below policy.xml example will disable the coders EPHEMERAL, URL, MVG, and MSL.
policy.xml
<policymap>
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
</policymap>
https://imagetragick.com/
脆弱性が修正されたバージョン(7.0.1-1 と 6.9.3-10)は今週末にリリース予定なので、それまでは上の policy.xml で対応すること
http://www.cwftgm535ug.net/
VIPQ2_EXTDAT: default:default:VIP931931:512:----: EXT was configured
