[35158] in bugtraq
Re: Format String Vulnerability in Tripwire
daemon@ATHENA.MIT.EDU (Ron Forrester)
Sat Jun 5 15:11:43 2004
Date: 4 Jun 2004 22:39:13 -0000
Message-ID: <20040604223913.12271.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Ron Forrester <rjf@tripwire.com>
To: bugtraq@securityfocus.com
In-Reply-To: <20040604175112.23294.qmail@www.securityfocus.com>
Okay folks, one more time.
We've identified a couple more important bits of information regarding this vulnerability, mainly that it is present only in the code for processing email reports when the MAILMETHOD is sendmail. This provides some important points of clarification:
1) It is not present in our Windows binaries, since sendmail is not an option on this platform.
2) Another, and probably best yet workaround on *nix, is to change from using sendmail to SMTP as your email method. This requires setting a couple of additional configuration variables (SMTPHOST and possibly SMTPPORT).
#2 is true of both our commercial *nix binaries as well as the open source version.
I'll let everyone know if we uncover additional information regarding this issue.
Cheers,
Ron Forrester
Security Architect
Tripwire, Inc.
