[UNIX] GIMP Can Print Erased Sections of Images

From: support@securiteam.com
Date: 10/31/02 

From: support@securiteam.com
To: list@securiteam.com
Date: 31 Oct 2002 12:16:09 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  GIMP Can Print Erased Sections of Images
------------------------------------------------------------------------

SUMMARY

A vulnerability in GIMP causes erased sections to print out, this could
cause sensitive information to be revealed.

DETAILS

If you take a screen capture and then chop stuff out that you don't want
the world to see. Doing this within GIMP by setting an alpha channel on
the screen capture and then erasing the parts of the image that you want
to obscure will still cause them to be printed.

The following is an example is at:
<http://c-mills.ctru.auckland.ac.nz/transparent.png>
http://c-mills.ctru.auckland.ac.nz/transparent.png

If you view this image from Linux in Galeon 1.2.6 or Netscape/7.0 all
looks fine however if you print the image from within these applications
then the erased section prints as if it was never erased.

On windows the images obscure which is great but obviously the erased
information is still in the sent image.

Vendor status:
The issue has been given Bug #97167.

ADDITIONAL INFORMATION

The information has been provided by <mailto:c.mills@auckland.ac.nz>
Clark Mills.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages