Re: tcpdump -z

On Fri, Aug 27, 2010 at 1:32 PM, Pieter de Boer
<pieter@xxxxxxxxxxxxxxxxxxx> wrote:
On 08/27/2010 10:32 AM, Vadim Goncharov wrote:

This is a froward message from tcpdump-workers mail list:
=== 8<  ================>8 ===
$ sudo ./tcpdump -i any -G 1 -z ./test.sh -w dump port 55555
[sudo] password for user:
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture
size
65535 bytes
(generate some traffic on port 55555)
root@blaa ~/temp/tcpdump-4.1.1$ id
uid=0(root) gid=0(root) groups=0(root)

Is this known and accepted? Could this option maybe be implemented
differently?

In my opinion, if you allow people to run tools as root using sudo, you'd
better make sure those tools don't allow attackers to easily gain root
access. In the case of tcpdump, the '-w' flag most probably already allowed
that, although '-z' is a bit more convenient to the attacker.

As a solution, configure your sudo correctly, only allowing specific tcpdump
command line options (or option sets) to be used.


If you care about security I would definetly dump sudo(8) in the first place...

Andy
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: tcpdump -z
    ... In my opinion, if you allow people to run tools as root using sudo, ... you'd better make sure those tools don't allow attackers to easily gain ... root access. ... In the case of tcpdump, the '-w' flag most probably already ...
    (FreeBSD-Security)
  • Re: tcpdump -z
    ... In my opinion, if you allow people to run tools as root using sudo, ... In the case of tcpdump, the '-w' flag most probably already ... your network with that type of sudo access to collect password ... information or any other sensitive information flow on your network. ...
    (FreeBSD-Security)
  • Re: tcpdump -z
    ... In my opinion, if you allow people to run tools as root using sudo, you'd better make sure those tools don't allow attackers to easily gain root access. ... In the case of tcpdump, the '-w' flag most probably already allowed that, although '-z' is a bit more convenient to the attacker. ...
    (FreeBSD-Security)
  • Re: tcpdump -z
    ... -" just works perfectly and they can run tcpdump. ... that wasn't an answer to my question or the claim of Andy. ... normal user, sudois the way to go. ... Well, yeah, if it's up to me, I'd like to see sudo in BASE, as OpenBSD ...
    (FreeBSD-Security)