PT-2012-5273 · Gnu+1 · Gimp+1

Giles Coochey · Published 2012-08-31 · Updated 2022-02-07 · CVE-2012-4245

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GIMP version 2.6

Description The issue concerns the scriptfu network server in GIMP, which does not require authentication. This allows remote attackers to execute arbitrary commands via the python-fu-eval command.

Recommendations For GIMP version 2.6, consider disabling the scriptfu network server until a patch is available to prevent remote attackers from executing arbitrary commands.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2012-4245

Affected Products

Debian

Gimp

References · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4245 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-4245 · Vendor Advisory
• https://security.gentoo.org/glsa/201603-01 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4245 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4245 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/gimp · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/08/16/6 · Note
• http://xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf · Note
• https://packages.debian.org/src:gimp · Note
• http://securityfocus.com/bid/55089 · Note
• http://openwall.com/lists/oss-security/2012/08/20/1 · Note
• http://reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-execution.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-08/0106.html · Note
• http://openwall.com/lists/oss-security/2012/08/17/2 · Note