Subject: Bug#4465: security hole in netdiag package

From: "Peter Tobias" <[email-masked]>
Date: Tue, 10 Sep 1996 14:13:15 +0200 (MET DST)

Package: netdiag
Version: 0.2-3

The postinst script copies the tcpdump binary from the tcpdump
package and the traceroute binary from the netstd package to /usr/bin
and makes them setuid root.adm. This allows all users in the existing
adm group to use tcpdump to get the unencrypted passwords that are
transmitted over the network.

IMHO the netdiag package shouldn't use tcpdump/traceroute
(neither as binaries nor as links). Copying/linking binaries from
other packages just to have them in /usr/bin is a bad idea. Maybe
something like this should be added to the guidelines.

Thanks,

Peter

-- 
 Peter Tobias                                EMail:
 Fachhochschule Ostfriesland                 [email-masked]
 Fachbereich Elektrotechnik und Informatik   [email-masked]
 Constantiaplatz 4, 26723 Emden, Germany     [email-masked]

---

From: Christoph Lameter <[email-masked]>
Date: Tue, 10 Sep 1996 06:10:53 -0700 (PDT)

Alright I tried all the ideas I had. What shall I do to get consistency
with network diagnostic tools that should be be in the hads of
troublemakers?

I know the adm group is not the right one. Shall I try to set up a new
group of users being able to use network diagnostics?

tcpdump and traceroute are essential network diagnostic tools. Somehow
they need to fit into the scheme. Before the netdiag package I manually
changed permissions on all machine I installed because our administrative
staff is doing troubleshooting on campus quite frequently.

Please respond by cc to me since I dont have access to debian-devel.

On Tue, 10 Sep 1996, Peter Tobias wrote:

tobias>Package: netdiag
tobias>Version: 0.2-3
tobias>
tobias>The postinst script copies the tcpdump binary from the tcpdump
tobias>package and the traceroute binary from the netstd package to /usr/bin
tobias>and makes them setuid root.adm. This allows all users in the existing
tobias>adm group to use tcpdump to get the unencrypted passwords that are
tobias>transmitted over the network.
tobias>
tobias>IMHO the netdiag package shouldn't use tcpdump/traceroute
tobias>(neither as binaries nor as links). Copying/linking binaries from
tobias>other packages just to have them in /usr/bin is a bad idea. Maybe
tobias>something like this should be added to the guidelines.
tobias>
tobias>
tobias>Thanks,
tobias>
tobias>Peter
tobias>
tobias>-- 
tobias> Peter Tobias                                EMail:
tobias> Fachhochschule Ostfriesland                 [email-masked]
tobias> Fachbereich Elektrotechnik und Informatik   [email-masked]
tobias> Constantiaplatz 4, 26723 Emden, Germany     [email-masked]
tobias>

{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}
{}    Snail Mail:   FTS Box 466, 135 N.Oakland Ave, Pasadena, CA 91182        {}
{}    FISH Internet System Administrator at Fuller Theological Seminary       {}
{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}
PGP Public Key  =  FB 9B 31 21 04 1E 3A 33  C7 62 2F C0 CD 81 CA B5

---

From: [email-masked]
Date: Tue, 10 Sep 96 11:29 EDT

Christoph> tcpdump and traceroute are essential network diagnostic
  Christoph> tools. 

But only for root.

  Christoph> Somehow they need to fit into the scheme. Before the netdiag
  Christoph> package I manually changed permissions on all machine I
  Christoph> installed because our administrative staff is doing
  Christoph> troubleshooting on campus quite frequently.

It's entirely your business what you do on the machines that you admin.

But you are plain WRONG to move binaries from other Debian packages around.
Please don't do that. And Peter is right --- this has to go into the
Guidelines. 

--
Dirk Eddelb"uttel                             http://qed.econ.queensu.ca/~edd

---

From: Michael Meskes <[email-masked]>
Date: Wed, 11 Sep 1996 13:06:40 +0200 (MET DST)

> transmitted over the network.

This is a real problem. But you probably cannot really fix it since you stil
have that possibily via another machine. My collegue tried this in recent
weeks and wondered why it didn't work until I told him about ssh. :-)

> something like this should be added to the guidelines.

Totally agreed. Just for curiosity, why were they moved anyway? Most users
who know these tools will figure out how to start them from /usr/sbin
anyway.

Michael

-- 
Michael Meskes                   |    _____ ________ __  ____
[email-masked] |   / ___// ____/ // / / __ \___  __________
[email-masked]                  |   \__ \/ /_  / // /_/ /_/ / _ \/ ___/ ___/
[email-masked]                |  ___/ / __/ /__  __/\__, /  __/ /  (__  )
Use Debian GNU/Linux!            | /____/_/      /_/  /____/\___/_/  /____/