The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to     execute arbitrary commands via the python-fu-eval command. (CVE-2012-4245)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201603-01 (GIMP: Multiple vulnerabilities)

    GIMP&rsquo;s network server, scriptfu, is vulnerable to the remote execution       of arbitrary code via the python-fu-eval command due to not requiring       authentication.  Additionally, the X Window Dump (XWD) plugin is       vulnerable to multiple buffer overflows possibly allowing the remote       execution of arbitrary code or Denial of Service.  The XWD plugin is       vulnerable due to not validating large color entries.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process due or perform a Denial of Service.
  Workaround :

    There is no known work around at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - The scriptfu network server in GIMP 2.6 does not require     authentication, which allows remote attackers to execute     arbitrary commands via the python-fu-eval command.
    (CVE-2012-4245)

ID	Name	Product	Family	Severity
217782	Linux Distros Unpatched Vulnerability : CVE-2012-4245	Nessus	Misc.	critical
89712	GLSA-201603-01 : GIMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
80621	Oracle Solaris Third-Party Patch Update : gimp (cve_2012_4245_arbitrary_code)	Nessus	Solaris Local Security Checks	medium

Detections

Analytics

CVE-2012-4245

critical

Tenable Plugins

critical

medium

medium