Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by smtp.simplesystems.org (8.14.4+Sun/8.14.4) with ESMTP id u54Mxcn6000542
	for <bfriesen@simple.dallas.tx.us>; Sat, 4 Jun 2016 17:59:39 -0500 (CDT)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 9D1FC35C024;
	Sat,  4 Jun 2016 17:59:34 -0500 (EST)
Received: from cmsa514.att.ne.jp (msa514.att.ne.jp [210.134.90.17])
	by lists.maptools.org (Postfix) with ESMTP id ECD6F35C024
	for <tiff@lists.maptools.org>; Sat,  4 Jun 2016 17:59:27 -0500 (EST)
Received: from vmsa514.att.ne.jp by cmsa514.att.ne.jp with ESMTP
	id <20160604225925085.OUXW.62805.cmsa514.att.ne.jp@msa514.att.ne.jp>
	for <tiff@lists.maptools.org>; Sun, 5 Jun 2016 07:59:25 +0900
Received: from msrg5141.rgserv.att.ne.jp by vmsa514.att.ne.jp with ESMTP
	id <20160604225925076.MGBG.59355.vmsa514.att.ne.jp@msa514.att.ne.jp>
	for <tiff@lists.maptools.org>; Sun, 5 Jun 2016 07:59:25 +0900
Received: from myhost (210.197.156.171) by msrg5141.rgserv.att.ne.jp
	(9.0.018.07.05) id 573D21B3004186C3 for tiff@lists.maptools.org;
	Sun, 5 Jun 2016 07:59:25 +0900
Date: Sun, 5 Jun 2016 07:59:25 +0900 (added by
	postmaster@msrg5141.rgserv.att.ne.jp)
Message-ID: <2016.06.05.0757.37563@afu.wta.att.ne.jp>
From: Prophet of the Way <afu@wta.att.ne.jp>
To: tiff@lists.maptools.org
Subject: [Tiff] TiffLib tools as a means for mitigating the ImageTragick
	exploit
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (smtp.simplesystems.org [65.66.246.90]); Sat, 04 Jun 2016 17:59:39 -0500 (CDT)
X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4
Status: RO
X-Status: A
X-Keywords:                
X-UID: 26

A major security whole was recently found in ImageMagick.  A name
"ImageMagick" was coined to get people's attention and a dedicated
website (https://imagetragick.com/) was set up.

Here is advice on mitigating the threat in a blog entry linked to the
ImageTragick site:

Clearing up some misconceptions around the "ImageTragick" bug 
https://lcamtuf.blogspot.jp/2016/05/clearing-up-some-misconceptions-around.html

  If all you need to do is simple transcoding or thumbnailing of potentially
  untrusted images, don't use ImageMagick.  Make a direct use of libpng,
  libjpeg-turbo, and giflib; for a robust way to use these libraries,
  have a look at the source code of Chromium or Firefox.  The resulting
  implementation will be considerably faster, too.

  - lcamtuf's blog May 11, 2016


One question I'd like to ask: how about the accessory programs which
come with TiffLib?  Using bmp2tiff, gif2tiff, tiff2pdf, etc. instead
of ImageMagick is in accord with the above advice, but how can one tell
that this is really an improvement security-wise?

I'd like to re-phrase my question in general terms.  One looking for
alternatives to ImageMagick for a certain task may encounter an image
processing tool which provides the necessary functions but whose name is
not well known.  Lack of publicity may well be an indication of absence
of active maintenance.  Where does one draw the line?


_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/

