PT-2004-1645 · Tripwire · Tripwire

Published 2004-06-08 · Updated 2017-07-11 · CVE-2004-0536

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tripwire commercial versions 4.0.1 and earlier Tripwire open source versions 2.3.1 and earlier

Description The issue allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report. This occurs due to a format string vulnerability.

Recommendations For Tripwire commercial versions 4.0.1 and earlier, consider updating to a version later than 4.0.1 to resolve the issue. For Tripwire open source versions 2.3.1 and earlier, consider updating to a version later than 2.3.1 to resolve the issue. As a temporary workaround, consider restricting the use of format string specifiers in file names to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0536

Affected Products

Tripwire

References · 10

• http://redhat.com/support/errata/RHSA-2004-244.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0536 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0536 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200406-02.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0536 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=108630983009228&w=2 · Note
• http://securityfocus.com/bid/10454 · Note
• http://marc.info/?l=bugtraq&m=108627481507249&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16309 · Note