bugtraq - Re: Format String Vulnerability in Tripwire

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040603215236.7815.qmail@www.securityfocus.com>
Date: 3 Jun 2004 21:52:36 -0000
From: Ron Forrester <rjf@...pwire.com>
To: bugtraq@...urityfocus.com
Subject: Re: Format String Vulnerability in Tripwire

In-Reply-To: <20040602234116.9A3674A5B@...nchfries.net>

Just a quick note that Tripwire confirms this vulnerability exists in our currently shipping commercial versions of Tripwire for Servers as well as the Open Source release on Sourceforge.

We have patched our commercial code base and the fix will be in the next version of TFS in early Q3 (August timeframe). 

I will endeavor to patch the sourceforge code base as soon as possible. In the meantime, it is strongly recommended that you apply Paul's patch and rebuild from source.

A big thanks to Paul for bringing this to our (and the communities) attention.

Ron Forrester
Security Architect
Tripwire, Inc.

>SUMMARY
>-------
>Tripwire(tm) is a Security, Intrusion Detection, Damage Assessment
>and Recovery, Forensics software.
>
>A vulnerability in the product allows a user on the local machine
>under certain circumstances to execute arbitrary code with the
>rights of the user running the program (typically root).
>
>
>VERSIONS AFFECTED
>-----------------
>Tripwire commercial versions <= 2.4
>Tripwire open source versions <= 2.3.1