{"id":85,"date":"2016-05-11T05:43:21","date_gmt":"2016-05-11T05:43:21","guid":{"rendered":"https:\/\/www.hostingahead.com\/blog\/?p=85"},"modified":"2016-05-11T10:03:32","modified_gmt":"2016-05-11T10:03:32","slug":"fix-imagemagick-vulnerability","status":"publish","type":"post","link":"https:\/\/www.hostingahead.com\/blog\/fix-imagemagick-vulnerability\/","title":{"rendered":"Fix ImageMagick vulnerability"},"content":{"rendered":"<p><a href=\"http:\/\/www.imagemagick.org\/script\/index.php\" target=\"_blank\">ImageMagick<\/a>, an open-source image processing software suite, has released versions 7.0.1-1 and 6.9.3-10 to address a vulnerability in previous software versions. Exploitation of this vulnerability may allow an attacker to take control of an affected system.<\/p>\n<p>Evidence :<\/p>\n<p><a href=\"http:\/\/arstechnica.com\/security\/2016\/05\/exploits-gone-wild-hackers-target-critical-image-processing-bug\/\" target=\"_blank\">http:\/\/arstechnica.com\/security\/2016\/05\/exploits-gone-wild-hackers-target-critical-image-processing-bug\/<\/a><br \/>\n<a href=\"https:\/\/www.us-cert.gov\/ncas\/current-activity\/2016\/05\/04\/ImageMagick-Vulnerability\" target=\"_blank\">https:\/\/www.us-cert.gov\/ncas\/current-activity\/2016\/05\/04\/ImageMagick-Vulnerability<\/a><\/p>\n<p>You can fix it by edit policy.xml file.<\/p>\n<p>Add following lines to policy.xml file<\/p>\n<blockquote><p>&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;EPHEMERAL&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;URL&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;HTTPS&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;MVG&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;MSL&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;TEXT&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;SHOW&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;WIN&#8221;&gt;&lt;\/policy&gt;<br \/>\n&lt;policy domain=&#8221;coder&#8221; rights=&#8221;none&#8221; pattern=&#8221;PLT&#8221;&gt;&lt;\/policy&gt;<\/p><\/blockquote>\n<p><strong>Default File path:<\/strong><\/p>\n<p>Ubuntu\/Debian 7\/CentOS\/RHEL\/Arch Linux : \/etc\/ImageMagick\/policy.xml<br \/>\nDebian 8\/Fedora : \/etc\/ImageMagick-6\/policy.xml<br \/>\nFreeBSD : \/usr\/local\/etc\/ImageMagick-6\/policy.xml<br \/>\nCentOS with cPanel\/WHM: \/usr\/local\/cpanel\/3rdparty\/etc\/ImageMagick-6\/policy.xml<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ImageMagick, an open-source image processing software suite, has released versions 7.0.1-1 and 6.9.3-10 to address a vulnerability in previous software versions. Exploitation of this vulnerability may allow an attacker to take control of an affected system. Evidence : http:\/\/arstechnica.com\/security\/2016\/05\/exploits-gone-wild-hackers-target-critical-image-processing-bug\/ https:\/\/www.us-cert.gov\/ncas\/current-activity\/2016\/05\/04\/ImageMagick-Vulnerability You can fix it by edit policy.xml file. Add following lines to policy.xml file &lt;policy &#8230;<\/p>\n","protected":false},"author":101012,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/posts\/85"}],"collection":[{"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/users\/101012"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/comments?post=85"}],"version-history":[{"count":8,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/posts\/85\/revisions"}],"predecessor-version":[{"id":95,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/posts\/85\/revisions\/95"}],"wp:attachment":[{"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/media?parent=85"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/categories?post=85"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostingahead.com\/blog\/wp-json\/wp\/v2\/tags?post=85"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}