« Volver al listado

CVE-2004-0536

Estado: ModificadaAlta (7.2)—

Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tripwire — Tripwire

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2004-0536",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-08-06T04:00:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=108627481507249&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=108630983009228&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200406-02.xml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2004-244.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/10454",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16309",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=108627481507249&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=108630983009228&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200406-02.xml",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2004-244.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/10454",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16309",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report."
    },
    {
      "lang": "es",
      "value": "Vulnerabildad de cadena de formato en Tripwire commercial 4.0.1 y anteriores, incluyendo 2.4, y open source 2.3.1 y anteriores permite a usuarios locales ganar privilegios mediante especificadores de cadena de formato en el nombre del ficheros, que es usado para la generación de un informe de correo electrónico."
    }
  ],
  "lastModified": "2026-06-16T22:05:50.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF3F4FED-7015-4797-9EBF-694B9EA9CE75"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD06AF56-3FB0-4005-AAA7-445C4D6C28B8"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC8EFFBB-90F1-40C3-BB31-7EFA125CBC1B"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.3.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B0E835C-5559-4C25-87DA-7A66ABF65069"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBD1A5C4-5401-4B13-81AD-A8E6E3E8A1B6"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:2.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC166ADE-A5C1-47D7-AF26-1B8A10D84DC4"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEEE4CC8-F0D8-4847-8A3D-23B5F77CA30E"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F34BD4EA-1753-4C8A-8E82-88CD3D78C235"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B35B7452-DA7F-4163-B0E7-3709696078E4"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7206607C-BEA0-430D-854C-3E1644F2FD2C"
            },
            {
              "criteria": "cpe:2.3:a:tripwire:tripwire:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00BD7075-528F-448B-A648-EFB8B32825C9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}