GIMP '.FIT' File Format Denial of Service Exploit Explained

What this paper is

This paper details a Denial of Service (DoS) vulnerability found in the GNU Image Manipulation Program (GIMP). Specifically, it affects how GIMP handles files in the Flexible Image Transport System (FITS) format. Versions of GIMP up to and including 2.8.0 on both Windows and Linux are vulnerable. The vulnerability is triggered by opening a specially crafted FITS file that has a malformed header, causing GIMP to crash.

Simple technical breakdown

The core of the problem lies in how GIMP reads and processes the XTENSION field within a FITS file's header. When GIMP encounters a FITS file with a corrupted XTENSION header, it attempts to copy data from a location that is not properly initialized (a null pointer). This invalid operation causes the program to crash, leading to a Denial of Service. The fix involves adding a check to ensure the XTENSION data is valid before attempting to copy it.

Complete code and payload walkthrough

The provided exploit is not a complex piece of code or shellcode. Instead, it's a specially crafted file that exploits a weakness in GIMP's file parsing logic. The "payload" is essentially the malformed file itself.

The original paper points to the vulnerable code snippet within fits-io.c:

{
fdat = fits_decode_card (fits_search_card (hdr, "XTENSION"), typ_fstring);
strcpy (hdulist->xtension, fdat->fstring);
}

And the patched code:

fdat = fits_decode_card (fits_search_card (hdr, "XTENSION"), typ_fstring);
if(fdat != NULL) {
strcpy (hdulist->xtension, fdat->fstring);
} else {
strcpy (errmsg, "No valid XTENSION header found.");
goto err_return;
}

The exploit file (19482.fit) is designed to trigger the vulnerable code path. While the exact byte-level structure of the 19482.fit file is not fully detailed in the paper, the paper states that a file starting with XTENSIONaaaaaaaaaaaaaaaaaaaaaa...aaaaaaaaaaaaaaaaaaaaaaaaHEADER2... will trigger the crash.

Let's break down the vulnerable code and its implications:

• fits_search_card (hdr, "XTENSION"): This function searches the FITS header (hdr) for a card (a line of metadata) with the key "XTENSION".
• fits_decode_card (..., typ_fstring): This function decodes the found "XTENSION" card into a structure (fdat) which contains the string value (fstring).
• fdat = ...: This assigns the result of the decoding to the fdat variable.
• strcpy (hdulist->xtension, fdat->fstring): This is the critical line. It attempts to copy the string from fdat->fstring into hdulist->xtension.

The Vulnerability: If fits_search_card or fits_decode_card fails to find or correctly decode the "XTENSION" card (e.g., due to malformation), fdat might be NULL. However, the strcpy function is called without checking if fdat is NULL. If fdat is NULL, fdat->fstring will attempt to dereference a NULL pointer, leading to a segmentation fault or access violation, crashing the program.

The exploit file (19482.fit) is crafted to ensure that fdat becomes NULL or points to invalid data when GIMP tries to process the XTENSION field, thus triggering the strcpy call with a NULL pointer.

Mapping list:

• fits_search_card (hdr, "XTENSION"): Locates the "XTENSION" metadata field in the FITS header.
• fits_decode_card (..., typ_fstring): Parses the value of the "XTENSION" field.
• fdat: A pointer to the decoded "XTENSION" card data.
• fdat->fstring: The string value of the "XTENSION" field.
• strcpy (hdulist->xtension, fdat->fstring): The vulnerable operation that copies the "XTENSION" string. If fdat is NULL, this causes a crash.
• 19482.fit (the file itself): The "payload" designed to trigger the NULL pointer dereference.

Shellcode/Payload Segments:

There is no traditional shellcode in this exploit. The "payload" is the malformed FITS file. The execution stage is simply GIMP attempting to open or preview this file.

Practical details for offensive operations teams

• Required Access Level: No elevated privileges are required. The vulnerability is triggered by a user opening a file.
• Lab Preconditions:
  • A target system with GIMP version 2.8.0 or earlier installed.
  • The ability to deliver the crafted .fit file to the target user.
• Tooling Assumptions:
  • A web server or file-sharing mechanism to deliver the exploit file.
  • A text editor or hex editor to inspect/modify the exploit file (though the provided 19482.fit is ready to use).
  • A vulnerable GIMP installation for testing.
• Execution Pitfalls:
  • GIMP Version: Ensuring the target GIMP version is indeed vulnerable (<= 2.8.0). Newer versions (2.8.1+) are patched.
  • File Preview: The vulnerability can be triggered not only by explicitly opening the file but also by the file explorer's preview pane if GIMP's file handler is invoked during preview. This is a significant tradecraft advantage.
  • Delivery Method: The effectiveness depends on tricking a user into opening or previewing the malicious file. Social engineering is likely required.
  • False Positives: If the target system has multiple image viewers or GIMP is not the default for .fit files, the exploit might not trigger.
• Tradecraft Considerations:
  • Social Engineering: Crafting a believable scenario for the user to open the .fit file is paramount. This could involve sending it as an attachment with a plausible story or placing it on a shared network drive with a tempting name.
  • File Naming: A misleading file name can increase the chances of the user opening it.
  • Targeting: This exploit is best suited for scenarios where you can influence a user's interaction with files, such as during a red team engagement where you have initial access or can deliver files to a user's workstation.
  • Reconnaissance: Confirming the GIMP version on target systems is crucial. This might be done through network scanning, endpoint assessment tools, or by observing user behavior.

Where this was used and when

• Discovery: The vulnerability was reported to the vendor on May 25, 2012.
• Publication: The advisory was published on June 30, 2012.
• Context: This type of vulnerability is typically found during security research and audits. While specific instances of its use in real-world attacks are not detailed in the paper, it was likely used by security researchers and potentially in penetration testing engagements shortly after its discovery. Its primary impact is a DoS, making it less likely to be used for persistent access but more for disruption.

Defensive lessons for modern teams

• File Format Validation: Robust validation of file headers and structures is critical. Input sanitization and checks for NULL pointers or unexpected data formats should be standard practice in file parsing libraries.
• Dependency Management: Keep all software, including applications like GIMP and their underlying libraries, updated to the latest stable versions. Patches often fix critical vulnerabilities.
• Least Privilege: Running applications with the least privilege necessary can limit the impact of a crash. While this exploit is a DoS, in other scenarios, a crash might lead to more severe consequences if the application has elevated privileges.
• Endpoint Detection and Response (EDR): EDR solutions can potentially detect anomalous file opening behavior or application crashes, even if they don't understand the specific vulnerability.
• User Education: Educating users about the risks of opening unexpected or untrusted files, especially those with unusual extensions, remains a vital layer of defense.

ASCII visual (if applicable)

This exploit is a file-based DoS, so a complex architectural diagram isn't strictly necessary. However, we can visualize the interaction:

+-----------------+      +-----------------------+      +-----------------+
| Attacker        |----->| Crafted .FIT file     |----->| GIMP Application|
| (Delivers file) |      | (Malformed XTENSION)  |      | (Vulnerable)    |
+-----------------+      +-----------------------+      +-----------------+
                                                                  |
                                                                  v
                                                           +-----------------+
                                                           | Application     |
                                                           | Crash (DoS)     |
                                                           +-----------------+

Source references

• Paper ID: 19482
• Paper Title: GIMP 2.8.0 - '.FIT' File Format Denial of Service
• Author: Joseph Sheridan
• Published: 2012-06-30
• Keywords: Multiple,dos
• Paper URL: https://www.exploit-db.com/papers/19482
• Raw URL: https://www.exploit-db.com/raw/19482
• CVE Number: CVE-2012-3236
• Vendor Homepage: http://www.gimp.org/

Original Exploit-DB Content (Verbatim)

Summary
=======

There is a file handling DoS in GIMP (the GNU Image Manipulation Program) for
the 'fit' file format affecting all versions (Windows and Linux) up to and 
including 2.8.0. A file in the fit format with a malformed 'XTENSION' header 
will cause a crash in the GIMP program.

CVE number: CVE-2012-3236
Vendor Homepage: http://www.gimp.org/
Date reported to vendor: 25/05/2012
Found by Joseph Sheridan:
href="http://www.reactionpenetrationtesting.co.uk/joseph-sheridan.html

This advisory is posted at:
http://www.reactionpenetrationtesting.co.uk/FIT-file-handling-DoS.html

PoC file is available here:
http://www.reactionpenetrationtesting.co.uk/vuln.fit
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19482.fit


Affected Products
=================

Vulnerable Products
+------------------

The following products are known to be affected by this vulnerability:

* GIMP <= 2.8.0 (Windows or Linux builds)

Products Not Vulnerable
+--------------------------------
* GIMP 2.8.1

Details
=======

There is a file handling DoS in GIMP (the GNU Image Manipulation Program) for
the 'fit' file format affecting all versions (Windows and Linux) up to 2.8.0. 
A file in the fit format with a malformed 'XTENSION' header will cause a crash 
in the GIMP program. The flaw is triggered by opening a crafted 'fit' file or 
allowing the file explorer dialog to preview the file.

A file in the fit format starting as follows will trigger the crash:
XTENSIONaaaaaaaaaaaaaaaaaaaaaa...aaaaaaaaaaaaaaaaaaaaaaaaHEADER2...

The vulnerable code is in the fits-io.c lines where the program attempts to 
copy from a null pointer:

{
fdat = fits_decode_card (fits_search_card (hdr, "XTENSION"), typ_fstring);
strcpy (hdulist->xtension, fdat->fstring);
}

This code can be patched by changing it to the following (as GIMP 2.8.1):

fdat = fits_decode_card (fits_search_card (hdr, "XTENSION"), typ_fstring);
if(fdat != NULL) {
strcpy (hdulist->xtension, fdat->fstring);
} else {
strcpy (errmsg, "No valid XTENSION header found.");
goto err_return;
}

Impact
======

Successful exploitation of the vulnerability may result in an application 
crash and denial of service.

Solution
===========
The GIMP team have provided an update for this issue (release 2.8.1).

Workarounds
===========

The fits-io.c file can be patched as above.

Distribution
============

In addition to posting on the website, a text version of this notice
is posted to the following e-mail and Usenet news recipients.

* bugtraq () securityfocus com
* full-disclosure () lists grok org uk
* oss [dash] security [dash] subscribe [at] lists [dot] openwall [dot] com

Future updates of this advisory, if any, will be placed on the ReactionIS
corporate website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the URL below for any updates:

http://www.reactionpenetrationtesting.co.uk/FIT-file-handling-DoS.html

========================================================================
====

Reaction Information Security 
Lombard House Business Centre,
Suite 117,
12-17 Upper Bridge Street,
Canterbury, Kent, CT1 2NF

Phone: +44 (0)1227 785050
Email: research () reactionis {dot} co {dot} uk
Web: http://www.reactionpenetrationtesting.co.uk

Joseph Sheridan
Technical Director
Principal Consultant
CHECK Team Leader, CREST Infrastructure, CREST Application, CISSP
Tel: 07812052515
Web: www.reactionis.com
Email: joe (at) reactionis.co (dot) uk [email concealed]

Reaction Information Security Limited.
Registered in England No: 6929383
Registered Office: 1, The Mews, 69 New Dover Road, Canterbury, CT1 3DZ

This email and any files transmitted with it are confidential and are intended solely for the use of the individual to whom they are addressed. If you are not the intended recipient please notify the sender. Any unauthorised dissemination or copying of this email or its attachments and any use or disclosure of any information contained in them, is strictly prohibited.

 Please consider the environment before printing this email