bugTiger UNIX security tool - Bugs: bug #24159, loopback device is not checked...

 
 

bug #24159: loopback device is not checked correctly

Submitter:  Richard Hauswald <richard_hauswald>
Submitted:  Fri 29 Aug 2008 11:52:43 AM UTC
   
 
Category:  Security check modules Severity:  3-Normal
Item Group:  Script error Status:  Fixed
Privacy:  Public Assigned to:  jfs
Open/Closed:  Open Operating System:  Any Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 04 Feb 2018 08:21:09 PM UTC, comment #1: 

I have modified the systems/Linux/2/check_listeningprocs to make it possible to check (using egrep) if the address starts by "127.". If it does this is then declared as a loopback address.

This change should fix the request below. Apologies for the delay.

Javier Fernandez-Sanguino Peña <jfs>
Group administrator
Fri 29 Aug 2008 11:52:43 AM UTC, original submission:  

Hello,
there is an error in the check routine which is responsible for reporting public listening daemons: It recognizes daemons running on 127.0.0.2 as public. AFAIK is the netmask of the virtual loopback network device 255.0.0.0 which means, that 127.0.0.2 is still local only. This is what tiger wrote into the logfile:

--WARN-- [lin003w] The process `xyz' is listening on socket 9103 (TCP on 127.0.0.2 interface) is run by xyzuser.

Processes that have not been run by root are listening on interfaces open
to the outside. This processes might have been run by root and changed
uids or might be rogue processes.  Confirm if their presence is necessary.
Notice that sometimes services open sporadic UDP listeners to receive
DNS requests, if you receive reports on open UDP services that later on
are closed this might be a false positive.


Continue the good work,
Richard

Richard Hauswald <richard_hauswald>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jfs (Posted a comment)
  • -email is unavailable- added by richard_hauswald (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-02-04 jfs Severity5-Critical 3-Normal
        StatusNone Fixed
        Assigned toNone jfs

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code