bugTiger UNIX security tool - Bugs: bug #24159, loopback device is not checked...

 
 

bug #24159: loopback device is not checked correctly

Submitted by:  Richard Hauswald <richard_hauswald>
Submitted on:  Fri 29 Aug 2008 11:52:43 AM UTC  
 
Category: Security check modulesSeverity: 5-Critical
Item Group: Script errorStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenOperating System: Any Linux

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 29 Aug 2008 11:52:43 AM UTC, original submission:

Hello,
there is an error in the check routine which is responsible for reporting public listening daemons: It recognizes daemons running on 127.0.0.2 as public. AFAIK is the netmask of the virtual loopback network device 255.0.0.0 which means, that 127.0.0.2 is still local only. This is what tiger wrote into the logfile:

--WARN-- [lin003w] The process `xyz' is listening on socket 9103 (TCP on 127.0.0.2 interface) is run by xyzuser.

Processes that have not been run by root are listening on interfaces open
to the outside. This processes might have been run by root and changed
uids or might be rogue processes. Confirm if their presence is necessary.
Notice that sometimes services open sporadic UDP listeners to receive
DNS requests, if you receive reports on open UDP services that later on
are closed this might be a false positive.

Continue the good work,
Richard

Richard Hauswald <richard_hauswald>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by richard_hauswald (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup