forged packets?

[pjintel () CYBERWAY COM SG (Kelvin Fu)]

All,

Forgive me if Im asking a stupid question this issue has been bothering
for quite some time now. Anyhow, here goes.

Marc SCHAEFER recently sent a message titled ' Local user can send
forged packets' to bugtraq. I quote :

"
NAME
   user-rawip-attack

ABSTRACT
   Forged packets can be send out from a Linux system, for example
   for NFS attacks or any other protocol relying on addresses for
   authentification, even when protected from the outside interfaces
   by firewalling rules. Most of the time, existing firewalling
   rules are bypassed. This requires at least a shell account on the
   system.

IMPACT
   Any local user can send any packet to any host from most Linux
default
   installations without of the use of any permission problem or
   suid flaw. Basically, it corresponds to having write only permissions
   to raw IP socket on the server machine."

AFAIK, a local user ( root?) on a linux system if running nmap is able
to perform decoy scans with the -D option. This option enables a user to
'spoof' his/her IP address to that of another host which will result in
the spoofed Ip to appear to be scanning the victim. If Im not wrong,
doesnt this ability to be able to spoof IP  addresses coincide with the
'user-rawip-attack' vulnerabilty addressed by Marc?

Any further comments or corrections will be greatly appreciated to clear
my (maybe others? )doubts.
Thanx in advance

-k