full-disclosure - ScriptFu Server Buffer Overflow in GIMP <= 2.6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 30 May 2012 23:38:29 +0100
From: "Joseph Sheridan" <joe@...ctionis.com>
To: "'full-disclosure'" <full-disclosure@...ts.grok.org.uk>,
	"'bugtraq'" <bugtraq@...urityfocus.com>, <secalert@...urityreason.com>,
	<bugs@...uritytracker.com>, "'vuln'" <vuln@...unia.com>,
	<vuln@...urity.nnov.ru>, <news@...uriteam.com>, <moderators@...db.org>,
	<submissions@...ketstormsecurity.org>, <submit@...ecurity.com>,
	<oss-security@...ts.openwall.com>
Subject: ScriptFu Server Buffer Overflow in GIMP <= 2.6

Vulnerability Summary

=================

 

There is a buffer overflow in the script-fu server component of GIMP 

(the GNU Image Manipulation Program) in all 2.6 versions (Windows and Linux
versions) affecting both 

the script-fu console and the script-fu network server. A crafted msg to the


script-fu server overflows a buffer and overwrites several function pointers


allowing the attacker to gain control of EIP and potentially execute
arbitrary 

code. This issue is fixed in the latest, stable GIMP version (currently
2.8.0).

 

CVE number: CVE-2012-2763

Impact: high

Vendor Homepage: http://www.gimp.org/

Date found: 18/05/2012

Found by: Joseph Sheridan of Reaction Information Security

Homepage: http://www.reactionpenetrationtesting.co.uk

 

This advisory is posted at:

http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overf
low-GIMP-2.6.html

 

PoC Code is available here:

http://www.reactionpenetrationtesting.co.uk/advisories/scriptfubof.c

 

Affected Products

=================

 

Vulnerable Products

+------------------

 

The following products are known to be affected by this vulnerability:

 

  * GIMP <= 2.6.12 (Windows or Linux builds)

 

Products Confirmed Not Vulnerable

+--------------------------------

 

The following products are known not to be affected by this

vulnerability:

 

  * GIMP 2.8.0 (current stable release)

 

Details

=======

 

There is a buffer overflow in the command parsing code such that a long
command

overwrites various function pointers on the heap and gives the attacker full
control 

of EIP. The following command sent to the script-fu server will trigger the 

vulnerability:

 

(file-bmp-load 123

aaaaaaaaaaaaa...a*1000...aaaaaaaaaa

raw-filename)

 

Impact

======

 

Successful exploitation of the vulnerability may result in remote code
execution.

 

Solution

===========

Upgrade to the latest stable version of GIMP (currently 2.8 branch) - the
2.6 branch is 

no longer supported by the GIMP development team.

 

Workarounds

===========

 

A workaround would be not to use this feature on a vulnerable version of
GIMP.

The GIMP development team have strongly suggested only using the 

script-fu network server in a secure/sandboxed environment due to 

security concerns.

 

Updates

============

 

Future updates of this advisory, if any, will be placed on the ReactionIS

corporate website, but may or may not be actively announced on

mailing lists or newsgroups. Users concerned about this problem are

encouraged to check the URL below for any updates:

 

http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overf
low-GIMP-2.6.html

 

============================================================================
====

 

Reaction Information Security 

Lombard House Business Centre,

Suite 117,

12-17 Upper Bridge Street,

Canterbury, Kent, CT1 2NF

 

Phone: +44 (0)1227 785050

Email: research () reactionis {dot} co {dot} uk

Web: http://www.reactionpenetrationtesting.co.uk


Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/