SOL61974123 - ImageMagick vulnerability CVE-2016-3718

Vulnerability Recommended Actions

If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in theVersions known to be not vulnerable column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.

BIG-IP/BIG-IQ/Enterprise Manager

To mitigate this vulnerability, you can disable the vulnerable ImageMagick coders in the global policy file**/etc/ImageMagick/policy.xml**. To do so, perform the following procedure:

Impact of action: Performing the following procedure should not have a negative impact on your system.

1. Log in to the command line of the affected system.
2. Back up the ImageMagickglobal policy file by typing the following command:

cp -p /etc/ImageMagick/policy.xml /var/tmp/policy.xml.sol61974123

3. Edit the ImageMagickglobal policy file using a text editor of your choice, for example vi.
4. Include the vulnerable ImageMagickcoders in the policymap stanza. For example, if theHTTPcoder is vulnerable, you would include the following line in thepolicymap stanza:

<policy domain=“coder” rights=“none” pattern=“HTTP” />

Since the vulnerable coders listed in CVE-2016-3718 are HTTP and FTP, the modified policymap stanza should look similar to the following example:

<policymap>
<policy domain=“coder” rights=“none” pattern=“HTTP” />
<policy domain=“coder” rights=“none” pattern=“FTP” />
</policymap>

5. Save the changes and exit the text editor.

Supplemental Information

• SOL9970: Subscribing to email notifications regarding F5 products
• SOL9957: Creating a custom RSS feed to view new and updated documents
• SOL4602: Overview of the F5 security vulnerability response policy
• SOL4918: Overview of the F5 critical issue hotfix policy
• SOL03151140: ImageMagick vulnerability CVE-2016-3714
• SOL10550253: ImageMagick vulnerability CVE-2016-3715
• SOL25102203: ImageMagick vulnerability CVE-2016-3716
• SOL29154575: ImageMagick vulnerability CVE-2016-3717
• The Accelerating Images with Image Optimization chapter of the BIG-IP Acceleration: Implementations guide

Note: For information about how to locate F5 product guides, refer to SOL12453464: Finding product documentation on AskF5.