Subject: Security Issues

From: [email-masked] (Ridvan Erdogan)
Date: Fri, 14 Jun 96 09:08:50 PDT

Hi all,

I just wonder why I need to be root to use MBone monitoring tools. Is there any
security holes in mrinfo, mtrace and others?

Thanks for your time.

Regards Ridvan...

---

From: Bill Fenner <[email-masked]>
Date: Fri, 14 Jun 1996 12:07:00 PDT

>security holes in mrinfo, mtrace and others?

mrinfo, mtrace et al need to be root in order to open the IGMP socket to send
and receive IGMP control messages.  I doubt that mrinfo, mtrace or mrmap have
any security holes, because all they do is send and receive control messages,
they don't open any files.

If you're really worried, you could try adding a "setuid(getuid())" right after
the call to igmp_init(), and see if the tools still work.  That way they
release their setuid status immediately after doing what they needed to be
root for.  (Assuming that you installed the binaries setuid and aren't just
running them as the root user)

  Bill