GIMP < 3.0.4 RCE (macOS)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(238428);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-5473");
  script_xref(name:"IAVB", value:"2025-B-0092-S");

  script_name(english:"GIMP < 3.0.4 RCE (macOS)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote macoOS host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of GIMP installed on the remote host is prior to 3.0.4. It is, therefore, is affected by
multiple vulnerabilities:

  - GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows 
    remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required
    to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. 
    The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper 
    validation of user-supplied data, which can result in an integer overflow before writing to memory. 
    An attacker can leverage this vulnerability to execute code in the context of the current process. 
    (CVE-2025-5473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.gimp.org/news/2025/05/18/gimp-3-0-4-released/#general-bugfixes
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?25df94d1");
  # https://www.zerodayinitiative.com/advisories/ZDI-25-321/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5afa003");
  script_set_attribute(attribute:"solution", value:
"Upgrade to GIMP version 3.0.4, or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-5473");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:gimp:gimp");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_gimp_installed.nbin");
  script_require_keys("installed_sw/Gimp", "Host/MacOSX/Version");

  exit(0);
}

include ('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Gimp', 'type': 'app'},
      'requires': [ {'scope': 'target', 'match': {'os': 'macos' } } ],
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '3.0.4'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);