Date: Mon, 4 Jan 1999 17:10:16 +0500 (KGT)
From: CyberPsychotic <fygrave@tigerteam.net>
To: BUGTRAQ@NETSPACE.ORG
Subject: [linux-security] Tripwire mess..
Cc: linux-security@redhat.com
This may be, or may not be a security issue, however, since alot of people
still use tripwire-1.2 or lesser versions(this is what shipped with R.H.
Linux 5.2 at least), they might be interested in following detail:
Chuck Campbell (campbell@neosoft.com) pointed me out that tripwire dies with
coredump on R.H. linux, if it hits a filename containing 128-255 characters.
Playing a bit with debugger I found out that the problem sits around the
line 417:
else if (iscntrl(*pcin)) {
*pcout++ = '\\';
*pcout++ = *(pccopy = octal_array[(int)(*pcin)]);
*pcout++ = *++pccopy;
*pcout++ = *++pccopy;
}
iscntrl here would return 'true' not only for [0-31] arg, but also for
[128-255]. It cause two problems here:
1. original octal_array contained only 127 elements, reference would go
outside the array with *pcin>127
2. pcin is declared as pointer to char, which caused a negative offset for
chars in range above 127. (and which actually caused coredump in this case)
bellow is the patch to tripwire 1.2 (as it is on coast.cs.purdue.edu, and
ftp.redhat.com sites), and message from Gene Spafford which I received for
responce to my message. I wasn't able to test this bug on commercial
tripwire, but since people still use free version, this problem still might
be applicable.
regards
Fyodor
-<cut here>-
--- src/utils.c.orig Mon Jul 25 22:23:16 1994
+++ src/utils.c Sun Jan 3 15:41:00 1999
@@ -384,7 +384,7 @@
char *filename;
{
static char filetmp[MAXPATHLEN+256];
- register char *pcin = filename, *pcout = filetmp;
+ register unsigned char *pcin = filename, *pcout = filetmp;
static char *octal_array[] = {
"000", "001", "002", "003", "004", "005", "006", "007",
"010", "011", "012", "013", "014", "015", "016", "017",
@@ -402,8 +402,24 @@
"150", "151", "152", "153", "154", "155", "156", "157",
"160", "161", "162", "163", "164", "165", "166", "167",
"170", "171", "172", "173", "174", "175", "176", "177",
+ "200", "201", "202", "203", "204", "205", "206", "207",
+ "210", "211", "212", "213", "214", "215", "216", "217",
+ "220", "221", "222", "223", "224", "225", "226", "227",
+ "230", "231", "232", "233", "234", "235", "236", "237",
+ "240", "241", "242", "243", "244", "245", "246", "247",
+ "250", "251", "252", "253", "254", "255", "256", "257",
+ "260", "261", "262", "263", "264", "265", "266", "267",
+ "270", "271", "272", "273", "274", "275", "276", "277",
+ "300", "301", "302", "303", "304", "305", "306", "307",
+ "310", "311", "312", "313", "314", "315", "316", "317",
+ "320", "321", "322", "323", "324", "325", "326", "327",
+ "330", "331", "332", "333", "334", "335", "336", "337",
+ "340", "341", "342", "343", "344", "345", "346", "347",
+ "350", "351", "352", "353", "354", "355", "356", "357",
+ "360", "361", "362", "363", "364", "365", "366", "367",
+ "370", "371", "372", "373", "374", "375", "376", "377",
};
- register char *pccopy;
+ register unsigned char *pccopy;
/* these only matter if they are the first character */
if (*pcin == '!' || *pcin == '=' || *pcin == '#')
--<cut here>--
---------- Forwarded message ----------
Date: Sun, 03 Jan 1999 10:25:36 -0500
From: Gene Spafford <spaf@cs.purdue.edu>
[Form-letter response, last modified 8/16/98]
Thanks for your inquiry about Tripwire.
In mid-December 1997, Tripwire Security Systems, Inc. (formerly Visual
Computing Corporation) acquired the license for our Tripwire
change/intrusion detection system. They are now marketing an enhanced,
supported version of Tripwire for Unix-based machines. They are also
planning a Windows NT version of Tripwire for release sometimes in late
1998. Gene Kim, my former student and the original author of Tripwire,
is the VP of TSS, and I may have some technical advisory role in these
developments. All enquiries about Tripwire sales and technical support
should be directed to:
W. Wyatt Starnes
President
Tripwire Security Systems, Inc.
615 SW Broadway
Portland, Oregon 97205
Phone: (503) 223-0280
FAX: (503) 223-0182
tripwire@tripwiresecurity.com
You can visit the Tripwire WWW site at
<http://www.tripwiresecurity.com/>; for details on the latest release of
the program, and for assistance with problems with previous versions.
Note that personnel at Purdue are no longer supporting Tripwire.
Please also note that Tripwire is a registered trademark of the Purdue
Research Foundation, and it is also licensed to TSS.
--
----------------------------------------------------------------------
Please refer to the information about this list as well as general
information about Linux security at http://www.aoy.com/Linux/Security.
----------------------------------------------------------------------
To unsubscribe:
mail -s unsubscribe linux-security-request@redhat.com < /dev/null
