====================================================================

                                 CERT-Renater

                     Note d'Information No. 2016/VULN188
_____________________________________________________________________

DATE                : 09/05/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running WordPress versions prior to 4.5.2.

======================================================================
https://wordpress.org/news/2016/05/wordpress-4-5-2/
https://make.wordpress.org/core/2016/05/06/imagemagick-vulnerability-information/
____________________________________________________________________

WordPress 4.5.2 Security Release

Posted May 6, 2016 by Helen Hou-Sandi. Filed under Releases, Security.

WordPress 4.5.2 is now available. This is a security release for all
previous versions and we strongly encourage you to update your sites
immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME
vulnerability through Plupload, the third-party library WordPress uses
for uploading files. WordPress versions 4.2 through 4.5.1 are
vulnerable to reflected XSS using specially crafted URIs through
MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing these
issues.

Both issues were analyzed and reported by Mario Heiderich, Masato
Kinugawa, and Filedescriptor from Cure53. Thanks to the team for
practicing responsible disclosure, and to the Plupload and
MediaElement.js teams for working closely with us to coördinate and fix
these issues.

Download WordPress 4.5.2 or venture over to Dashboard → Updates and
simply click “Update Now.” Sites that support automatic background
updates are already beginning to update to WordPress 4.5.2.

Additionally, there are multiple widely publicized vulnerabilities in
the ImageMagick image processing library, which is used by a number of
hosts and is supported in WordPress. For our current response to these
issues, see this post on the core development blog.

_____________________________________________________________________

   Joe Hoyle 1:32 pm on May 6, 2016	

ImageMagick Vulnerability Information

A few days ago an ImageMagick vulnerability was disclosed dubbed
“ImageTragick” that affects WordPress websites whose host has
ImageMagick installed. If you control your own hosting for your
WordPress site, you should look to implement the following fix(es)
immediately.

The full effect of this issue is still unfolding and it’s not clear
what the full impact will be; however, there are mitigation steps that
should keep you safe with the known exploits so far. This vulnerability
is already being exploited in the wild, and proof of concepts are being
published.


How is WordPress affected?

Uploaded images to the WordPress admin that contain malicious data can
perform a number of exploits via the underlying ImageMagick library.
Uploads are available to all users who have the upload_files
capability. By default that’s authors, editors, and administrators;
contributors, subscribers, and anonymous users do not have that
capability. This issue is still developing; however, it should be noted
that if un-patched, this exploit allows for Remote Code Execution (RCE).


What steps is the WordPress Core Team taking to mitigate this?

The exploit is in the Imagick PHP extension, not WordPress itself (or
any library that is shipped with WordPress). The WordPress Security
Team is exploring ways to help mitigate this exploit due to the wide
usage of ImageMagick in the WordPress ecosystem; however, this exploit
is best handled at the hosting level (instructions below).


How do I know if my site is vulnerable?

If you do not control your own hosting environment then it’s likely
that your host is taking steps to fix the issue. We recommend you reach
out to your hosting provider to verify they are handling the
“ImageTragick (CVE-2016-3714, CVE-2016-3718 and CVE-2016-3715)” exploit.

Only WordPress sites that have the PHP Imagick extension installed are
vulnerable to this exploit. If you don’t know if your server has this
PHP extension, there are a few ways to identify this:

      Inspect the output of the phpinfo() function for “Imagick”.
      Run php -m | grep imagick on the command line.


How do I patch the vulnerability?

Currently the best known fix is to add a policy.xml file to your
ImageMagick installation to limit the delegates that ImageMagick will
use. Due to the ongoing nature of this issue, we recommend you refer to
and follow https://imagetragick.com/ for instructions on how to handle
the problem.

ImageMagick 6.9.3-10

ImageMagick released an update on 2016-05-03 to fix this issue;
however, there are questions around whether this update provides a
complete fix. At the time of writing it should be presumed version
6.9.3-10 does not fix the issues completely and you should take steps
to patch the issue via the policy.xml file.


Further reading

More information and updates on this exploit can be found at
https://imagetragick.com/. We recommend you keep an eye out for updates
to this issue, as the full extent of problem is still being discovered.

Documentation on the policy.xml file can be found at 
https://www.imagemagick.org/script/resources.php.

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================