Vulnerability CVE-2004-0981

Vulnerability Name:

CVE-2004-0981 (CCN-17903)

Assigned:

2004-10-06

Published:

2004-10-06

Updated:

2017-10-11

Summary:

Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: SGI Security Advisory 20041203-01-U
SGI Advanced Linux Environment 3 Security Update #20

Source: MITRE
Type: CNA
CVE-2004-0981

Source: CCN
Type: RHSA-2004-636
ImageMagick security update

Source: CCN
Type: SA12995
ImageMagick EXIF Parser Buffer Overflow Vulnerability

Source: SECUNIA
Type: UNKNOWN
12995

Source: GENTOO
Type: UNKNOWN
GLSA-200411-11

Source: DEBIAN
Type: DSA-593
imagemagick -- buffer overflow

Source: CCN
Type: GLSA-200411-11
ImageMagick: EXIF buffer overflow

Source: CCN
Type: ImageMagick Web site
ImageMagick - Convert, Edit, and Compose Images

Source: CONFIRM
Type: UNKNOWN
http://www.imagemagick.org/www/Changelog.html

Source: CCN
Type: BID-11548
ImageMagick Remote EXIF Parsing Buffer Overflow Vulnerability

Source: BID
Type: UNKNOWN
11548

Source: CCN
Type: TLSA-2005-7
Buffer overflow

Source: CCN
Type: USN-10-1
XML library vulnerabilities

Source: CCN
Type: USN-7-1
imagemagick vulnerability

Source: XF
Type: UNKNOWN
imagemagick-exif-image-bo(17903)

Source: XF
Type: UNKNOWN
imagemagick-exif-image-bo(17903)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10472

Source: UBUNTU
Type: UNKNOWN
USN-7-1

Vulnerable Configuration:

Configuration 1:

cpe:/a:imagemagick:imagemagick:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.4.3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.4.4.5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.4.7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.4.8:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.4.8.2.1.1.0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.5.3.2.1.2.0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.5.6.0_2003-04-09:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:5.5.7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.1:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.3:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.4:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.5:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.6:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.7:*:*:*:*:*:*:*

OR cpe:/a:imagemagick:imagemagick:6.0.8:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:3.0:*:alpha:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:arm:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:hppa:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:m68k:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:mips:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:ppc:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:s-390:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.0:*:sparc:*:*:*:*:*

OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20040981	V	CVE-2004-0981	2015-11-16
oval:org.mitre.oval:def:10472	V	Buffer overflow in the EXIF parsing routine in ImageMagick before 6.1.0 allows remote attackers to execute arbitrary code via a certain image file.	2013-04-29
oval:com.redhat.rhsa:def:20040636	P	RHSA-2004:636: ImageMagick security update (Important)	2004-12-08
oval:org.debian:def:593	V	buffer overflow	2004-11-16

BACK