tripwire: Format string vulnerability

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200406-02 / tripwire
Release Date	June 04, 2004
Latest Revision	May 22, 2006: 02
Impact	high
Exploitable	local

Package	Vulnerable versions	Unaffected versions	Architecture(s)
app-admin/tripwire	<= 2.3.1.2	>= 2.3.1.2-r1	All supported architectures

Related bugreports: #52945

Synopsis

A vulnerability allowing arbitrary code execution under certain circumstances has been found.

2. Impact Information

Background

tripwire is an open source file integrity checker.

Description

The code that generates email reports contains a format string vulnerability in pipedmailmessage.cpp.

Impact

With a carefully crafted filename on a local filesystem an attacker could cause execution of arbitrary code with permissions of the user running tripwire, which could be the root user.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All tripwire users should upgrade to the latest stable version:

Code Listing 3.1: Resolution

# emerge sync

# emerge -pv ">=app-admin/tripwire-2.3.1.2-r1"
# emerge ">=app-admin/tripwire-2.3.1.2-r1"

4. References

Page updated June 04, 2004

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.