Legacy ImageMagick Discussions Archive

trav's mitigation worked for me with ImageMagick 6.2.
6.5 and 6.7 took the policy.xml mitigation.
6.0 does not appear to be susceptible to the MVG exploit per the test in the Redhat article above.

Obviously your mileage may vary, this is just my experience.

Thanks for the idea trav.

Looks like you have a syntax error in your policy file fmw42 (I'm guessing) since it isn't listing any actual policy statements. On CentOS 6 (i think) machines where I've applied the mitigation I get: # convert -list policy Path: [built-in] Policy: Undefined rights: None Path: /usr/lib64/ImageMagick ...

# convert -version zsh: command not found: convert Sounds to me like you don't use imagemagick. Just because WP has files that mention IM, doesn't mean it is in use, just that it supports it. Your WP installation may use GD or some other image manipulation library. You may get some confirmation by ...

fmw42 wrote:I believe that he means

Code: Select all

convert -list resource

That may work too, but I did mean "policy" as it shows the results of the lines added to the policy file. I used it as a way to confirm the additions had been read correctly.

>Or do I need to apply the polycy mentioned above? As I read it, yes you need to do the update AND add that one policy line (as opposed to adding several policy lines with the unpatched version). >is the path /usr/local/etc/ImageMagick-6/policy.xml the correct place to edit the policy file? The path ...

Even newer version (of CentOS at least) don't have policy.xml by default, you simply add the file to the config directory you discovered (that contains configure.xml). However, with 6.2 "convert -list policy" results in "convert: unrecognized list type `policy'." which suggests the policy file may ...

I see my question is effectively the same as viewtopic.php?f=2&t=29614

What versions are affected by this? I have some legacy machines running 6.2.8 that don't understand "convert -list policy". Is it safe to assume they aren't vulnerable?