Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0343 advisory.

    [2.0.5-6.2.el4]
     - replace incorrect use of %{interfacever} macro with 2.0

     [2.0.5-6.1.el4]
     - avoid buffer overflow in sunras plugin (#238420)
     - own used directories in gimp-devel

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Marsu discovered a stack overflow bug in The GIMP RAS file loader. An attacker could create a carefully crafted file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-2356)

For users of Red Hat Enterprise Linux 5, the previous GIMP packages had a bug that concerned the execution order in which the symbolic links to externally packaged GIMP plugins are installed and removed, causing the symbolic links to vanish when the package is updated.

Specially crafted RAS files could cause a buffer overflow in the SUNRAS plugin. The bug could potentially be exploited to execute arbitrary code. (CVE-2007-2356)

It was discovered that Gimp did not correctly handle RAS image format color tables. By tricking a user into opening a specially crafted RAS file with Gimp, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted RAS files could cause a buffer overflow in the SUNRAS plugin. The bug could potentially be exploited to execute arbitrary code (CVE-2007-2356).

A buffer overflow has been identified in Gimp's SUNRAS plugin in versions prior to 2.2.15. This bug could allow an attacker to execute arbitrary code on the victim's computer by inducing the victim to open a specially crafted RAS file.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0343 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and     editing program.

    Marsu discovered a stack overflow bug in The GIMP RAS file loader.  An     attacker could create a carefully crafted file that could cause The GIMP to     crash or possibly execute arbitrary code if the file was opened by a     victim.  (CVE-2007-2356)

    For users of Red Hat Enterprise Linux 5, the previous GIMP packages had a     bug that concerned the execution order in which the symbolic links to     externally packaged GIMP plugins are installed and removed, causing the     symbolic links to vanish when the package is updated.

    Users of The GIMP should update to these erratum packages which contain a     backported fix to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Marsu discovered a stack overflow issue in the GIMP's RAS file loader.
An attacker could create a carefully crafted file that would cause the GIMP to crash or potentially execute arbitrary code as the user opening the file.

The updated packages have been patched to prevent this issue.

Updated gimp packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Marsu discovered a stack overflow bug in The GIMP RAS file loader. An attacker could create a carefully crafted file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-2356)

For users of Red Hat Enterprise Linux 5, the previous GIMP packages had a bug that concerned the execution order in which the symbolic links to externally packaged GIMP plugins are installed and removed, causing the symbolic links to vanish when the package is updated.

Users of The GIMP should update to these erratum packages which contain a backported fix to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200705-08 (GIMP: Buffer overflow)

    Marsu discovered that the 'set_color_table()' function in the SUNRAS     plugin is vulnerable to a stack-based buffer overflow.
  Impact :

    An attacker could entice a user to open a specially crafted .RAS file,     possibly leading to the execution of arbitrary code with the privileges     of the user running GIMP.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67491	Oracle Linux 5 : Moderate: / gimp (ELSA-2007-0343)	Nessus	Oracle Linux Local Security Checks	critical
60187	Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29442	SuSE 10 Security Update : gimp (ZYPP Patch Number 3283)	Nessus	SuSE Local Security Checks	medium
28067	Ubuntu 6.06 LTS / 6.10 / 7.04 : gimp vulnerability (USN-467-1)	Nessus	Ubuntu Local Security Checks	medium
27239	openSUSE 10 Security Update : gimp-unstable (gimp-unstable-3281)	Nessus	SuSE Local Security Checks	medium
27235	openSUSE 10 Security Update : gimp (gimp-3282)	Nessus	SuSE Local Security Checks	medium
25503	Debian DSA-1301-1 : gimp - buffer overflow	Nessus	Debian Local Security Checks	medium
25331	RHEL 4 / 5 : gimp (RHSA-2007:0343)	Nessus	Red Hat Local Security Checks	critical
25310	Mandrake Linux Security Advisory : gimp (MDKSA-2007:108)	Nessus	Mandriva Local Security Checks	medium
25298	CentOS 3 / 4 / 5 : gimp (CESA-2007:0343)	Nessus	CentOS Local Security Checks	medium
25185	GLSA-200705-08 : GIMP: Buffer overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-2356

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium