Bug 855929 - (CVE-2012-4245) CVE-2012-4245 gimp: arbitrary code execution without authentication in scriptfu network server
CVE-2012-4245 gimp: arbitrary code execution without authentication in script...
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
  Show dependency treegraph
Reported: 2012-09-10 11:59 EDT by Vincent Danen
Modified: 2015-08-19 05:18 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-09-10 12:14:59 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-09-10 11:59:26 EDT
The GIMP upstream reported [1] that the scriptfu network server allowed for the execution of arbitrary code when the scriptfu server is enabled.

The scriptfu network server is designed to execute arbitrary code, so there is no trust boundary crossed.  Upstream indicates that the other part of the problem is that it does without asking for authentication, but it was never designed to do so.  All that is required is for the TCP port (usually port 10008) to be available.

There is no upstream fix or solution for this flaw, and the workaround as stated is:

"Do not enable the scriptfu network server. The GIMP development team have stated that this component was not designed with security in mind and therefore should not be used in production environments."

[1] http://www.openwall.com/lists/oss-security/2012/08/16/6
Comment 1 Vincent Danen 2012-09-10 12:14:59 EDT

Red Hat does not consider this to be a security flaw.  The GIMP scriptfu server works as intended and should not be enabled in production environments as it was not designed to have any kind of security protection.

Note You need to log in before you can comment on or make changes to this bug.