bugtraq - Re: sing (debian) vunlerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:  Tue, 4 Dec 2007 22:11:46 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject:  Re: sing (debian) vunlerability?

Milen Rangelov wrote:
> The sing utility (Send Nasty ICMP Garbage) is a ping replacement that
> allows sending ICMP packets with spoofed source and custom ICMP
> types/codes (http://sourceforge.net/projects/sing).
>
> The debian package provides sing as a suid binary (actually,
> the sid distribution asks the user whether he'd like it installed suid,
> I'm not 100% sure, but in etch, it installs it suid, anyway, should
> check).

Thanks for bringing this to our attention.

However, above statement is not correct. Both the sing packages in
Debian oldstable (Sarge) and Debian stable (Etch) do not provide a setuid
root binary by default. The override status is handled by debconf and
defaults to no:

|  For 'sing' to work for non-root users, it needs to be suid.                                                          
|                                                                                                                         
|  Please keep in mind that making 'sing' suid, allows non-root users to
|  send spoofed ICMP messages from your machine.  
|                                                                                                                         
|  If you don't know what that means, refuse to make it suid here, and
|  run 'sing' only as root.                         

Cheers,
        Moritz