Comprimised version of ImageMagick

[RedKarl]

Hi siteguys,
When I go to install and congfigure ImageMagick in Gallery I get the following securint warning:
Warning: This version of ImageMagick has a known vulnerability that can be exploited to cause infinite loops. You may wish to upgrade. This determination may be inaccurate for Debian.

When I click on the link in the message: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2005-1739
I am told that all versions up to 6.2.2 are vulnerable to the security flaw. I am also told in Gallery that you have version 6.0.7 installed.

Are there plans to upgrage the version you have installed?

Thanks for your great work by the way.

[Cinder]

Hello,

We have installed the latest version of ImageMagic on the server hosting your account, which should resolve the problem with the error message that you are currently receiving.

root@sg5:~/ImageMagick-6.2.9#/usr/bin/convert -v
Version: ImageMagick 6.2.9 08/17/06 Q16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2006 ImageMagick Studio LLC

[RedKarl]

Hi John,
Thanks for the prompt reply but when I tried it again this morning I get the same message in Gallery. It seems that you still have the comprimised version: 6.0.7 installed on my server. By the way, how do you know what server is hosting my account? I never gave you those details and my login to this board doesn't include them anywhere. You must have gnosis! :-)

[Cinder]

Hello,

Well it wasn't easy but I think we've managed to locate your account by investigating your previous posts I will not say which one it is since you haven't done so yourself so far.

Anyways, I will assume that your account is hosted on the siteground5.com server (unless you have more than one account with us), which has the latest version of ImageMagic available:

root@sg5:~# /usr/bin/convert
Version: ImageMagick 6.2.9 08/17/06 Q16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2006 ImageMagick Studio LLC

If we are mistaken, please state which your account is, or on which it is hosted on.

[RedKarl]

Thanks for your reply again John, my installation of Gallery is still reporting the old comprimised version.

The server ip address is 67.15.250.7 (from my control panel), the site name is supashotz.com.

Thanks again for your work.

[rodpacker]

I've had a different problem, probably caused by the same fact, which is that some ISP's have an internal cache to save traffic (which is I think pretty weird).
However result of this is, that you will still get the old data (your error message) for a few days even though you deleted your local cache (have you done that yet?)
Easiest way to make sure this isn't your problem, is to go to somebody else's computer and try it from there (if it is a friend, ask what webprovider he is going through to make sure he isn't using the same ISP as u are )
cheers
rodpacker

[RedKarl]

Yes, good point rodpacker. Just a question first to the Siteground people: now I have given you my domain details, have you checked that the software has indeed been updated on that server? Thanks again.
-Karl-

[RedKarl]

siteground support, the Directory I'm using to point to ImageMagick/GraphicsMagick binaries is /usr/bin/ is that the correct directory I should be using? It is still saying that it has the comprimised version: 6.0.7

[RedKarl]

Does anybody else using siteground for shared hosting Gallery2 have this issue? Or is it only me?

[Cinder]

Hello,

We have upgraded the ImageMagick tool on the server hosting your supashotz.com

/usr/bin/convert
Version: ImageMagick 6.2.9 08/22/06 Q16 http://www.imagemagick.org
Copyright: Copyright (C) 1999-2006 ImageMagick Studio LLC

The prefix you should be using when installing the Gallery script is /usr/bin/ as you have been using so far.

You should now be able to install Gallery without any futrher troubles.

[RedKarl]

Ahaaaaa! Thank you for your help. I have installed Imagemagick at last.