CVE-2012-2763
published 2012-07-12CVE-2012-2763: Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers…
PriorityP266high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
81.72%
99.6th percentile
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.8.0-1 (bookworm) | gimp 2.8.0-1 (bookworm) |
| gimp | gimp | <= 2.6.13 | — |
| gimp | gimp | >= 0 < 2.8.0-1 | 2.8.0-1 |
| gimp | gimp | >= 0 < 2.8.0-1 | 2.8.0-1 |
| gimp | gimp | >= 0 < 2.8.0-1 | 2.8.0-1 |
| gimp | gimp | >= 0 < 2.8.0-1 | 2.8.0-1 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x47 (Magic byte 'G') followed by 2-byte big-endian length, then command payload
- →Monitor for TCP connections to port 10008 (GIMP script-fu server default port); large payloads (>1086 bytes) sent to this port are indicative of exploitation attempts. ↗
- →Detect script-fu protocol packets starting with magic byte 0x47 ('G') followed by a 2-byte big-endian length field where the declared length exceeds safe bounds (e.g., >1086 bytes for GIMP 2.6.1, >1102 bytes for GIMP 2.6.10). ↗
- →The overflow overwrites function pointers in the .bss segment (uninitialized global variables); specifically dword_420E20 is overwritten to redirect EIP via a 'call edx' instruction at 0x0040c86d. ↗
- →For GIMP 2.6.10 target, EIP control is achieved at offset 1102 with return address 0x00425a52 (EDX as BufferRegister); for GIMP 2.6.1, offset 1086 with return address 0x00425a22 (EAX as BufferRegister). ↗
- →The vulnerable function is readstr_upto in plug-ins/script-fu/tinyscheme/scheme.c; process-level monitoring of script-fu.exe for anomalous memory access violations (0xc0000005) can indicate active exploitation. ↗
- ·The script-fu server must be explicitly started by the user; it is not enabled by default, significantly limiting remote attack surface. ↗
- ·Exploitation targets Windows builds without DEP; DEP-enabled systems are not covered by the documented targets. ↗
- ·Red Hat assessed this as low severity and will not fix it in RHEL 5 or RHEL 6; Debian resolved it in GIMP 2.8.0-1. ↗
- ·Payload space is limited to 1024 bytes and must avoid bad characters \x00\x09\x0a\x0d\x20\x28\x29\x3b and all bytes 0x80–0xff. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gimp: Heap-based buffer overflow in the script-fu console by sending overly long arguments to script-fu server
vendor_redhat·2012-05-30·CVSS 7.5
CVE-2012-2763 [HIGH] CWE-122 gimp: Heap-based buffer overflow in the script-fu console by sending overly long arguments to script-fu server
gimp: Heap-based buffer overflow in the script-fu console by sending overly long arguments to script-fu server
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
Statement: The Red Hat Security Response Team has rated this issue as having low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: gimp (Red Hat Enterprise Linux 5) - Not affected
Package: gimp (Red Hat Enterprise Linux 6) - Will not fix
Debian
CVE-2012-2763: gimp - Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/sc...
vendor_debian·2012·CVSS 7.5
CVE-2012-2763 [HIGH] CVE-2012-2763: gimp - Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/sc...
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
Scope: local
bookworm: resolved (fixed in 2.8.0-1)
bullseye: resolved (fixed in 2.8.0-1)
forky: resolved (fixed in 2.8.0-1)
sid: resolved (fixed in 2.8.0-1)
trixie: resolved (fixed in 2.8.0-1)
GHSA
GHSA-9m8q-7xwp-9w66: Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme
ghsa_unreviewed·2022-05-13
CVE-2012-2763 [HIGH] CWE-120 GHSA-9m8q-7xwp-9w66: Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
OSV
CVE-2012-2763: Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme
osv·2012-07-12·CVSS 7.5
CVE-2012-2763 [HIGH] CVE-2012-2763: Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
No detection rules found.
Exploit-DB
GIMP script-fu - Server Buffer Overflow (Metasploit)
exploitdb·2012-06-02
CVE-2012-2763 GIMP script-fu - Server Buffer Overflow (Metasploit)
GIMP script-fu - Server Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'GIMP script-fu Server Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the script-fu server
component on GIMP
[
'Joseph Sheridan', # Vulnerability Discovery and PoC
'juan vazquez' # Metasploit module
],
'Version' => '$Revision: $',
'References' =>
[
[ 'CVE', '2012-2763' ],
[ 'OSVDB', '82429' ],
[ 'BID', '53741' ],
[ 'EDB', '18956' ],
[ 'URL', 'http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.
Exploit-DB
GIMP 2.6 script-fu < 2.8.0 - Buffer Overflow (PoC)
exploitdb·2012-05-31·CVSS 7.5
CVE-2012-2763 [HIGH] GIMP 2.6 script-fu < 2.8.0 - Buffer Overflow (PoC)
GIMP 2.6 script-fu
#include
#include
#include
#define DEFAULT_PORT 10008
// TCP socket type
#define DEFAULT_PROTO SOCK_STREAM
void senddata();
void recvdata();
WSADATA wsaData;
SOCKET conn_socket;
char Buffer[2000000];
char inBuffer[128];
void Usage()
{
printf("Usage: scriptfubof servername portnumber\n");
fflush(stdout);
exit(1);
}
int main(int argc, char *argv[])
{
// default to localhost
char *server_name= "localhost";
unsigned short port = DEFAULT_PORT;
int i, loopcount, maxloop=-1;
int retval;
unsigned int addr;
int socket_type = DEFAULT_PROTO;
struct sockaddr_in server;
if (argc < 3) {
Usage();
}
if ((retval = WSAStartup(0x202, &wsaData)) != 0)
{
fprintf(stderr,"WSAStartup() failed with error %d\n", retval);
WSACleanup();
return -1;
}
// Get portnum
port = atoi(argv[2]);
mems
Metasploit
GIMP script-fu Server Buffer Overflow
metasploit
GIMP script-fu Server Buffer Overflow
GIMP script-fu Server Buffer Overflow
This module exploits a buffer overflow in the script-fu server component on GIMP <= 2.6.12. By sending a specially crafted packet, an attacker may be able to achieve remote code execution under the context of the user. This module has been tested on GIMP for Windows from installers provided by Jernej Simoncic.
http://git.gnome.org/browse/gimp/commit/?h=gimp-2-6&id=744f7a4a2b5acb8b531a6f5dd8744ebb95348fc2http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2012-09/msg00043.htmlhttp://secunia.com/advisories/50737http://security.gentoo.org/glsa/glsa-201209-23.xmlhttp://www.openwall.com/lists/oss-security/2012/05/31/1http://www.openwall.com/lists/oss-security/2012/07/01/1http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.6.htmlhttps://bugzilla.gnome.org/show_bug.cgi?id=679215http://git.gnome.org/browse/gimp/commit/?h=gimp-2-6&id=744f7a4a2b5acb8b531a6f5dd8744ebb95348fc2http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2012-09/msg00043.htmlhttp://secunia.com/advisories/50737http://security.gentoo.org/glsa/glsa-201209-23.xmlhttp://www.openwall.com/lists/oss-security/2012/05/31/1http://www.openwall.com/lists/oss-security/2012/07/01/1http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.6.htmlhttps://bugzilla.gnome.org/show_bug.cgi?id=679215
2012-07-12
Published