Yahoobleed – Yahoo retired ImageMagick library after flaw leaked private e-mail attachments and credentials
Yahoobleed – Yahoo retired the ImageMagick library after flaw leaked sensitive data, including credentials and e-mail attachments.
Supply chain risks are realized when a negative impact to one of your suppliers has a negative impact on your business. If you are a manufacturer, an outage to a component supplier could prevent you from manufacturing; if you are a retailer, a
compromise of your air conditioning supplier could compromise
your payment systems; and if you are Yahoo! a vulnerability in an image processing library could compromise sensitive Yahoo Mail details.
ImageMagick is a widely used
program whose primary purpose is to “create, edit, compose or convert bitmap images.” It has been around since 1990 and with support for a wide range of interfaces including C++, Lisp, Perl, PHP, Python it has been integrated into countless programs, operating systems, and applications. Including some of the largest Internet websites — like Facebook and Yahoo!
Vulnerabilities have been identified in ImageMagick libraries over the years, but the past year has highlighted the impact such a library has when it is widely deployed. In May 2014, security researchers identified an ImageMagick that allowed “malformed images to force a Web server to execute code of an attacker’s choosing.” It was noted that many “social media and blogging sites” rely on ImageMagick and in October of 2016,
Facebook paid a $40,000 bounty after learning they were one of those affected.
“In my previous post on Yahoobleed #1 (YB1), we saw how an uninitialized memory vulnerability could lead to disclosure of private images belonging to other users. The resulting leaked memory bytes were subject to JPEG compression, which is not a problem for image theft, but is somewhat lacking if we wanted to steal memory content other than images.” states Chris Evans.
“In this post, we explore an alternative *bleed class vulnerability in Yahoo! thumbnailing servers. Let’s call it Yahoobleed #2 (YB2). We’ll get around the (still present) JPEG compression issue to exfiltrate raw memory bytes. With subsequent usage of the elite cyberhacking tool “strings”, we discover many wonders.
Yahoo! fixed YB2 at the same time as YB1, by retiring ImageMagick.”
When successfully exploited, by sending a Yahoo Mail user an 18-byte image file, these two vulnerabilities could give up Yahoo Mail users’ image attachments, browser cookies and authentication tokens. YB1 is a new vulnerability identified by Evan and the latest ImageMagick code already contains the necessary fix. The YB2 vulnerability was patched in 2015, but Yahoo Mail had not updated to a fixed version of the library.
The hard work of library developers doesn’t help if the application developers are unable to keep up with the latest patches. Perhaps it was this reason that led Yahoo! to take the ultimate ImageMagick fix and stop using the library altogether. Developers increasingly rely on a combination of frameworks and libraries to quickly create complex applications. But that means that they are increasingly vulnerable to software supply chain risks. Identifying, mitigating and responding to these risks will continue to be a challenge — maybe it is time to reduce the number of libraries?
As Chris Evans
notes, “The combination of running an ImageMagick that is both old and also unrestricted in the enabled decoders is dangerous. The fix of retiring ImageMagick should take care of both those issues :)”
About the author: Steve Biswanger has over 20 years experience in Information Security consulting, and is a frequent speaker on risk, ICS and IoT topics. He is currently Director of Information Security for Encana, a North American oil & gas company and sits on the Board of Directors for the (ISC)2 Alberta Chapter.
Pierluigi Paganini
May 23, 2017
