The traceroute command must be group-owned by wheel.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4370	GEN003980 M6	SV-38027r1_rule	ECLP-1	Medium

Description
If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information potentially leading to system and network compromise.

STIG	Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft	2013-01-10

Details

Check Text ( C-37596r1_chk )
Open a terminal session and enter the following command to verify the group ownership of the traceroute command. ls -lL /usr/sbin/traceroute If the traceroute command is not group owned by wheel, this is a finding.

Fix Text (F-32838r1_fix)
Open a terminal session and enter the following command to set the group ownership of the traceroute command. chgrp wheel /usr/sbin/traceroute