bugTiger UNIX security tool - Bugs: bug #24159, loopback device is not checked...


bug #24159: loopback device is not checked correctly

Submitted by:  Richard Hauswald <richard_hauswald>
Submitted on:  Fri 29 Aug 2008 11:52:43 AM UTC  
Category:  Security check modules Severity:  3-Normal
Item Group:  Script error Status:  Fixed
Privacy:  Public Assigned to:  Javier Fernandez-Sanguino Peña <jfs>
Open/Closed:  Open Operating System:  Any Linux

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 04 Feb 2018 08:21:09 PM UTC, comment #1: 

I have modified the systems/Linux/2/check_listeningprocs to make it possible to check (using egrep) if the address starts by "127.". If it does this is then declared as a loopback address.

This change should fix the request below. Apologies for the delay.

Javier Fernandez-Sanguino Peña <jfs>
Project AdministratorIn charge of this item.
Fri 29 Aug 2008 11:52:43 AM UTC, original submission:  

there is an error in the check routine which is responsible for reporting public listening daemons: It recognizes daemons running on as public. AFAIK is the netmask of the virtual loopback network device which means, that is still local only. This is what tiger wrote into the logfile:

--WARN-- [lin003w] The process `xyz' is listening on socket 9103 (TCP on interface) is run by xyzuser.

Processes that have not been run by root are listening on interfaces open
to the outside. This processes might have been run by root and changed
uids or might be rogue processes.  Confirm if their presence is necessary.
Notice that sometimes services open sporadic UDP listeners to receive
DNS requests, if you receive reports on open UDP services that later on
are closed this might be a false positive.

Continue the good work,

Richard Hauswald <richard_hauswald>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by jfs (Posted a comment)
  • -email is unavailable- added by richard_hauswald (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-02-04 jfs Severity5-Critical => 3-Normal
        StatusNone => Fixed
        Assigned toNone => jfs

    Back to the top

    Powered by Savane 3.7