PT-2012-5273 · Gnu+1 · Gimp+1

Giles Coochey · Publicado 2012-08-31 · Atualizado 2022-02-07 · CVE-2012-4245

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GIMP version 2.6

Description The issue concerns the scriptfu network server in GIMP, which does not require authentication. This allows remote attackers to execute arbitrary commands via the python-fu-eval command.

Recommendations For GIMP version 2.6, consider disabling the scriptfu network server until a patch is available to prevent remote attackers from executing arbitrary commands.

Correção

RCE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2012-4245

Produtos afetados

Debian

Gimp

Referências · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4245 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/16/6 · Nota
• http://xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf · Nota
• https://packages.debian.org/src:gimp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4245 · Nota de Segurança
• http://securityfocus.com/bid/55089 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-4245 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/20/1 · Nota
• https://security.gentoo.org/glsa/201603-01 · Aviso do Fabricante
• http://reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-execution.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4245 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2012-08/0106.html · Nota
• https://osv.dev/vulnerability/CVE-2012-4245 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/17/2 · Nota
• https://security-tracker.debian.org/tracker/source-package/gimp · Aviso do Fabricante