PT-2004-1645 · Tripwire · Tripwire

Publicado 2004-06-08 · Atualizado 2017-07-11 · CVE-2004-0536

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tripwire commercial versions 4.0.1 and earlier Tripwire open source versions 2.3.1 and earlier

Description The issue allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report. This occurs due to a format string vulnerability.

Recommendations For Tripwire commercial versions 4.0.1 and earlier, consider updating to a version later than 4.0.1 to resolve the issue. For Tripwire open source versions 2.3.1 and earlier, consider updating to a version later than 2.3.1 to resolve the issue. As a temporary workaround, consider restricting the use of format string specifiers in file names to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-0536

Produtos afetados

Tripwire

Referências · 10

• http://marc.info/?l=bugtraq&m=108630983009228&w=2 · Nota
• http://securityfocus.com/bid/10454 · Nota
• http://redhat.com/support/errata/RHSA-2004-244.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0536 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0536 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200406-02.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2004-0536 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2004-0536 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108627481507249&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16309 · Nota