Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've heard there may be security concerns when using ImageMagick on arbitrary user-provided images. For example, the link below gives evidence that there used to be some buffer overflow exploits. Does anyone know if I can now safely use this as part of a web service dealing with user images?

http://rhn.redhat.com/errata/RHSA-2006-0633.html

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

That security advisory is from 2006. All software has bugs, but I wouldn't say that ImageMagick has more than other software. Seriously, if you are implementing a web service, you're probably just as likely to get hacked by someone through Apache than with ImageMagick.

In short, don't worry about it, but do keep all your software up to date.

EDIT: by the way, I helped a client implement a web service that used ImageMagick, and I never heard of one problem with it.

share|improve this answer
add comment

Yes there is a security risk - software has bugs and some of them can be used to attack the system it runs on.

But you can minimize the risk:

  1. Create a user account that has a minimum of permissions so that it is just enough for running ImageMagick. Now use only that account for executing ImageMagick

  2. Enable automatical security updates: Linux systems like Ubuntu can be configured to install automatically install security fixes. This decreases the time your system is vulnerable in case a vulnerability will be found. Windows system also has an auto update system but that does not include third party software like ImageMagick.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.