Description
Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tripwire | 2.3.1.2.0-2.1 | — |
| Debian 13 | tripwire | 2.3.1.2.0-2.1 | — |
| Debian 12 | tripwire | 2.3.1.2.0-2.1 | — |
References
- tripwire-fprintf-format-string(16309) vdb-entry
- 20040603 Re: Format String Vulnerability in Tripwire mailing-list
- RHSA-2004:244 vendor-advisory
- GLSA-200406-02 vendor-advisory
- 20040602 Format String Vulnerability in Tripwire mailing-list
- 10454 vdb-entry