Bug 855929 (CVE-2012-4245)

Summary:	CVE-2012-4245 gimp: arbitrary code execution without authentication in scriptfu network server
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	nphilipp
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-09-10 16:14:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2012-09-10 15:59:26 UTC

The GIMP upstream reported [1] that the scriptfu network server allowed for the execution of arbitrary code when the scriptfu server is enabled.

The scriptfu network server is designed to execute arbitrary code, so there is no trust boundary crossed.  Upstream indicates that the other part of the problem is that it does without asking for authentication, but it was never designed to do so.  All that is required is for the TCP port (usually port 10008) to be available.

There is no upstream fix or solution for this flaw, and the workaround as stated is:

"Do not enable the scriptfu network server. The GIMP development team have stated that this component was not designed with security in mind and therefore should not be used in production environments."

[1] http://www.openwall.com/lists/oss-security/2012/08/16/6

Comment 1 Vincent Danen 2012-09-10 16:14:59 UTC

Statement:

Red Hat does not consider this to be a security flaw.  The GIMP scriptfu server works as intended and should not be enabled in production environments as it was not designed to have any kind of security protection.