Paul Herman has discovered a vulnerability in Tripwire, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a format string error within the "cPipedMailMessage::SendString()" function when generating email reports. This can be exploited by placing a file with a specially crafted filename containing format specifiers in a location being monitored by Tripwire.

Successful exploitation requires that Tripwire is configured to generate email reports with "sendmail" as MAILMETHOD.

The vulnerability has been reported in the following versions:
* Tripwire (commercial version) 4.0.1 and prior
* Tripwire (open source version) 2.3.1 and prior

Solution
The vendor has addressed the vulnerability in their commercial code base.
Further details available in Customer Area

Provided and/or discovered by
Paul Herman

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area