The binary we will be fuzzing is “ magick”, also known as “magick tool”. This will compile and install ImageMagick with AFL instrumentation. To compile and install ImageMagick with AFL for our case, we can use following commands: $CC=afl-gcc CXX=afl=g++ CFLAGS=”-ggdb -O0 -fsanitize=address,undefined -fno-omit-frame-pointer” LDFLAGS=”-ggdb -fsanitize=address,undefined -fno-omit-frame-pointer”. We can customize various parameters as per our needs. ImageMagick has lot of configuration options which we can see by running following command: $./configure –help Fuzzing ImageMagick is very well documented, so we will be quickly covering the process in this blog post and will focus on the root cause analysis of the issue we have found. Fuzzing ImageMagick:įuzzing open source libraries has been covered in a detailed blog “Vulnerability Discovery in Open Source Libraries Part 1: Tools of the Trade” last year.

Despite the efforts of many to expose such vulnerabilities, recent fuzzing research from McAfee has exposed new vulnerabilities involving processing of multiple image formats, in various open source and closed source software and libraries including ImageMagick and Windows GDI+. This research has resulted in various vulnerability discoveries that must be addressed on a regular basis by its maintainers. Google OSS Fuzz and other threat researchers have made ImageMagick the frequent focus of fuzzing, an extremely popular technique used by security researchers to discover potential zero-day vulnerabilities in open, as well as closed source software. It is used for editing, creating or converting various digital image formats and supports various formats like PNG, JPEG, WEBP, TIFF, HEIC and PDF, among others. It is available for the Windows, Linux, MacOS platforms as well as Android and iOS.

ImageMagick is a hugely popular open source software that is used in lot of systems around the world.

What is imagemagick