Re: Format String Vulnerability in Tripwire

[Ron Forrester <rjf () tripwire com>]

In-Reply-To: <20040604175112.23294.qmail () www securityfocus com>


Okay folks, one more time.

We've identified a couple more important bits of information regarding this vulnerability, mainly that it is present 
only in the code for processing email reports when the MAILMETHOD is sendmail. This provides some important points of 
clarification:

1) It is not present in our Windows binaries, since sendmail is not an option on this platform.

2) Another, and probably best yet workaround on *nix, is to change from using sendmail to SMTP as your email method. 
This requires setting a couple of additional configuration variables (SMTPHOST and possibly SMTPPORT).

#2 is true of both our commercial *nix binaries as well as the open source version.

I'll let everyone know if we uncover additional information regarding this issue.

Cheers,

Ron Forrester
Security Architect
Tripwire, Inc.