18-Byte ImageMagick Hack Could Have Leaked Images From Yahoo Mail Server

After the discovery of a critical vulnerability that could have allowed hackers to view private Yahoo Mail images, Yahoo retired the image-processing library ImageMagick.

ImageMagick is an open-source image processing library that lets users resize, scale, crop, watermarking and tweak images. The tool is supported by PHP, Python, Ruby, Perl, C++, and many other programming languages.

This popular image-processing library made headline last year with the discovery of the then-zero-day vulnerability, dubbed

ImageTragick

, which allowed hackers to execute malicious code on a Web server by uploading a maliciously-crafted image.

Now, just last week, security researcher Chris Evans

demonstrated

an 18-byte exploit to the public that could be used to cause Yahoo servers to leak other users' private Yahoo! Mail image attachments.

'Yahoobleed' Bug Leaks Images From Server Memory

The exploit abuses a security vulnerability in the ImageMagick library, which Evans dubbed "

Yahoobleed

#1" (YB1) because the flaw caused the service to bleed contents stored in server memory.

The vulnerability actually exists in the obscure

RLE

(Utah Raster Toolkit Run Length Encoded) image format.

To exploit the vulnerability, all an attacker need to do is create a maliciously crafted RLE image, and send it to the victim's email address, and then create a loop of empty RLE protocol commands, prompting the leakage of information.

To show how it is possible to compromise a Yahoo email account, Evans, as a proof-of-concept (PoC) demonstration, created a malicious image containing 18-byte exploit code and emailed it as an email attachment to himself.

Once the attachment reached the Yahoo's email servers, ImageMagick processed the image to generate thumbnails and previews, but due to the execution of Evans' exploit code, the library generated a corrupt image preview for the image attachment.

Once this image attachment is clicked, it launched the image preview pane, causing the service to display portions of images that were still present in the server's memory, instead of the original image.

"The resulting JPEG image served to my browser is based on uninitialized, or previously freed, memory content," Evans said.

Unlike

Heartbleed

and

Cloudbleed

that were due to out-of-bounds server side memory content leaks, Evans said

Yahoobleed

makes use of uninitialized or previously freed, memory content.

"The previous bleed vulnerabilities have typically been out-of-bounds reads, but this one is the use of uninitialized memory," Evans said. "An uninitialized image decode buffer is used as the basis for an image rendered back to the client." 

"This leaks server-side memory. This type of vulnerability is fairly stealthy compared to an out-of-bounds read because the server will never crash. However, the leaked secrets will be limited to those present in freed heap chunks."

Yahoo Retires 'Buggy' ImageMagick Library

After Evans had submitted his 18-byte exploit code to Yahoo, the company decided to retire the ImageMagick library altogether, rather than fixing the issue.

Evans also warned of another version of Yahoobleed, dubbed

Yahoobleed2

, which was the due to Yahoo's failure to install a critical patch

released

in January 2015. He said the flaws combined could allow attackers to obtain browser cookies, authentication tokens, and private images belonging to Yahoo Mail users.

Evans was awarded a bug bounty payment of $14,000 -- $778 per byte for his exploit code -- by the tech giant, who decided to double the bounty to $28,000 after knowing Evans intention to donated his reward to a charity.

After Yahoo has been aware of the issue, Evans reported the vulnerability to the ImageMagick team, who released ImageMagick

version 7.0.5-1

two months ago with a fix for the issue.

So, Other widely used Web services using the ImageMagick library are likely still vulnerable to the bug and are advised to apply the patches as soon as possible.

from The Hacker News http://ift.tt/2q5SUA8