Format String Vulnerability in Tripwire

[Paul Herman]

SUMMARY
-------
Tripwire(tm) is a Security, Intrusion Detection, Damage Assessment
and Recovery, Forensics software.

A vulnerability in the product allows a user on the local machine
under certain circumstances to execute arbitrary code with the
rights of the user running the program (typically root).


VERSIONS AFFECTED
-----------------
Tripwire commercial versions <= 2.4
Tripwire open source versions <= 2.3.1


DETAILS
-------
A format string vulnerability exists when tripwire generates an
email report (i.e. 'tripwire -m c -M'). Each line of the report is
passed to an fprintf() function in pipedmailmessage.cpp in the
following manner:

fprintf(mpFile, s.c_str() );

If a local user were to create a file with a carefully crafted
filename on the local system, that filename may be included in the
report and passed to fprintf() (albeit from the heap.) No exploit
is known at this time, but the author of this advisory believes
this vulnerability could be exploitable.

Tripwire Inc. has been notified and has implemented a fix.


IMPACT
------
This vulnerability allows an attacker to execute arbitrary code
with the rights of the user running the file check, which is
typically root. The vulnerability exists only when tripwire is used
to generate an email report. Users who do not generate an email
report are not affected by this vulnerability.


WORKAROUND
----------
Disable email reporting. All users are advised to upgrade to a
version which is not vulnerable.


PATCH
-----
If you are using Open Source Tripwire(tm) version 2.3.1, the
following patch will fix this particular issue:

Index: src/tripwire/pipedmailmessage.cpp
================================================== =================
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- src/tripwire/pipedmailmessage.cpp 21 Jan 2001 00:46:48 -0000 1.1
+++ src/tripwire/pipedmailmessage.cpp 26 May 2004 20:59:15 -0000 1.2
@@ -180,7 +180,7 @@

void cPipedMailMessage::SendString( const TSTRING& s )
{
- if( _ftprintf( mpFile, s.c_str() ) < 0 )
+ if( _ftprintf( mpFile, "%s", s.c_str() ) < 0 )
{
TOSTRINGSTREAM estr;
estr << TSS_GetString( cTripwire, tripwire::STR_ERR2_MAIL_MESSAGE_COMMAND )


AUTHOR OF ADVISORY
------------------
Paul Herman <pherman@frenchfries.net>


ACKNOWLEDGEMENT
---------------
I would like to thank Robert C. Jacobson <8dgb6hw02@sneakemail.com>
for an initial bug report which led to me discovering this
vulnerability.


TRIPWIRE TRADEMARK NOTICE
-------------------------
The developer of the original code and/or files is Tripwire, Inc.
Portions created by Tripwire, Inc. are copyright 2000 Tripwire,
Inc. Tripwire is a registered trademark of Tripwire, Inc. All
rights reserved.

Nothing in the GNU General Public License or any other license to
use the code or files shall permit you to use Tripwire's
trademarks, service marks, or other intellectual property without
Tripwire's prior written consent in the form of a license agreement
signed by an officer of Tripwire, Inc.

If you have any questions, please contact Tripwire, Inc. at either
info@tripwire.org or www.tripwire.org.

[Ron Forrester]

In-Reply-To: <20040602234116.9A3674A5B@frenchfries.net>


Just a quick note that Tripwire confirms this vulnerability exists in our currently shipping commercial versions of Tripwire for Servers as well as the Open Source release on Sourceforge.

We have patched our commercial code base and the fix will be in the next version of TFS in early Q3 (August timeframe).

I will endeavor to patch the sourceforge code base as soon as possible. In the meantime, it is strongly recommended that you apply Paul's patch and rebuild from source.

A big thanks to Paul for bringing this to our (and the communities) attention.

Ron Forrester
Security Architect
Tripwire, Inc.


>SUMMARY
>-------
>Tripwire(tm) is a Security, Intrusion Detection, Damage Assessment
>and Recovery, Forensics software.
>
>A vulnerability in the product allows a user on the local machine
>under certain circumstances to execute arbitrary code with the
>rights of the user running the program (typically root).
>
>
>VERSIONS AFFECTED
>-----------------
>Tripwire commercial versions <= 2.4
>Tripwire open source versions <= 2.3.1

[Ron Forrester]

In-Reply-To: <20040603215236.7815.qmail@www.securityfocus.com>


One more quick note -- I think I had a brain freeze and gave Paul the wrong commerical version numbers. This vulnerability exists in all currently shipping TFS releases, which means <= 4.0.1.

Sorry I didn't catch this the first time.

Ron Forrester
Security Architect
Tripwire, Inc.

>>VERSIONS AFFECTED
>>-----------------
>>Tripwire commercial versions <= 2.4
>>Tripwire open source versions <= 2.3.1
>

[Ron Forrester]

In-Reply-To: <20040604175112.23294.qmail@www.securityfocus.com>


Okay folks, one more time.

We've identified a couple more important bits of information regarding this vulnerability, mainly that it is present only in the code for processing email reports when the MAILMETHOD is sendmail. This provides some important points of clarification:

1) It is not present in our Windows binaries, since sendmail is not an option on this platform.

2) Another, and probably best yet workaround on *nix, is to change from using sendmail to SMTP as your email method. This requires setting a couple of additional configuration variables (SMTPHOST and possibly SMTPPORT).

#2 is true of both our commercial *nix binaries as well as the open source version.

I'll let everyone know if we uncover additional information regarding this issue.

Cheers,

Ron Forrester
Security Architect
Tripwire, Inc.