• Products
  • Openwall GNU/*/Linux server OS
  • Linux Kernel Runtime Guard
  • John the Ripper password cracker
    • Free & Open Source for any platform
    • in the cloud
    • Pro for Linux
    • Pro for macOS
  • Wordlists for password cracking
  • passwdqc policy enforcement
    • Free & Open Source for Unix
    • Pro for Windows (Active Directory)
  • yescrypt KDF & password hashing
  • yespower Proof-of-Work (PoW)
  • crypt_blowfish password hashing
  • phpass ditto in PHP
  • tcb better password shadowing
  • Pluggable Authentication Modules
  • scanlogd port scan detector
  • popa3d tiny POP3 daemon
  • blists web interface to mailing lists
  • msulogin single user mode login
  • php_mt_seed mt_rand() cracker
• Services
• Publications
  • Articles
  • Presentations
• Resources
  • Mailing lists
  • Community wiki
  • Source code repositories (GitHub)
  • Source code repositories (CVSweb)
  • File archive & mirrors
  • How to verify digital signatures
  • OVE IDs
• What’s new

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 Aug 2012 00:32:58 +0100 From: “research” <research@…ctionis.co.uk> To: ‘Julius Kivimäki’ <julius.kivimaki@…il.com> Cc: “’full-disclosure’” <full-disclosure@…ts.grok.org.uk>, “’bugtraq’” <bugtraq@…urityfocus.com>, <secalert@…urityreason.com>, <bugs@…uritytracker.com>, “’vuln’” <vuln@…unia.com>, <vuln@…urity.nnov.ru>, <news@…uriteam.com>, <moderators@…db.org>, <submissions@…ketstormsecurity.org>, <submit@…ecurity.com>, <oss-security@…ts.openwall.com> Subject: RE: [Full-disclosure] GIMP Scriptfu Python Remote Command Execution

The scriptfu network server (when enabled) does not require authentication and will run commands from anyone that can connect to its tcp port (usually 10008).

From: Julius Kivimäki [mailto:julius.kivimaki@…il.com] Sent: 17 August 2012 11:26 To: research Cc: full-disclosure; bugtraq; secalert@…urityreason.com; bugs@…uritytracker.com; vuln; vuln@…urity.nnov.ru; news@…uriteam.com; moderators@…db.org; submissions@…ketstormsecurity.org; submit@…ecurity.com; oss-security@…ts.openwall.com Subject: Re: [Full-disclosure] GIMP Scriptfu Python Remote Command Execution

Where exactly is the vulnerability here? I am unable to see it myself, it appears that you are using an eval function to evaluate code which isn’t exactly a security issue.

2012/8/17 research <research@…ctionis.co.uk>

Summary

There is an arbitrary command execution vulnerability in the scriptfu network server console in the GIMP 2.6 branch. It is possible to use a python scriptfu command to run arbitrary operating-system commands and potentially take full control of the host.

The advisory is posted here: http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-exe <http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-ex e%0d%0acution.html> cution.html

CVE number: CVE-2012-4245 Vendor homepage: http://www.gimp.org/ Vendor notified: 9/8/2012

Affected Products

GIMP 2.6 branch (Windows or Linux builds)

Non-Affected Products

The Scriptfu network server component does not currently work in the GIMP 2.8 branch (Windows or Linux builds).

Details

There is an arbitrary command execution vulnerability in the scriptfu network server console in the GIMP 2.6 branch. It is possible to use a python scriptfu command to run arbitrary operating-system commands and potentially take full control of the host. The following command will write “foo” to "/tmp/owned":

(python-fu-eval 0 "file = open(‘/tmp/owned’,’w’)\nfile.write(‘foo’)")

Impact

Successful exploitation of the vulnerability may result in remote command execution.

Solution

No solution has been implemented at this stage apart from the workaround below.

Workaround

Do not enable the scriptfu network server. The GIMP development team have stated that this component was not designed with security in mind and therefore should not be used in production environments.

Distribution

In addition to posting on the website, a text version of this notice is posted to the following e-mail and Usenet news recipients.

* bugtraq () securityfocus com * full-disclosure () lists grok org uk

Future updates of this advisory, if any, will be placed on the ReactionIS corporate website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL below for any updates:

http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-exe <http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-ex e%0d%0acution.html> cution.html

============================================================================

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.