Bugtraq: Re: sing (debian) vunlerability?

[Moritz Muehlenhoff <jmm () debian org>]

Milen Rangelov wrote:
> The sing utility (Send Nasty ICMP Garbage) is a ping replacement that
> allows sending ICMP packets with spoofed source and custom ICMP
> types/codes (http://sourceforge.net/projects/sing).
>
> The debian package provides sing as a suid binary (actually,
> the sid distribution asks the user whether he'd like it installed suid,
> I'm not 100% sure, but in etch, it installs it suid, anyway, should
> check).
Thanks for bringing this to our attention.

However, above statement is not correct. Both the sing packages in
Debian oldstable (Sarge) and Debian stable (Etch) do not provide a setuid
root binary by default. The override status is handled by debconf and
defaults to no:

|  For 'sing' to work for non-root users, it needs to be suid.                                                          
|                                                                                                                       
  
|  Please keep in mind that making 'sing' suid, allows non-root users to
|  send spoofed ICMP messages from your machine.  
|                                                                                                                       
  
|  If you don't know what that means, refuse to make it suid here, and
|  run 'sing' only as root.                         

Cheers,
        Moritz