UCF STIG Viewer Logo

The traceroute command must be group-owned by sys, bin, or root.


Overview

Finding ID Version Rule ID IA Controls Severity
V-4370 GEN003980 SV-28395r1_rule ECLP-1 Medium
Description
If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.
STIG Date
SOLARIS 9 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE 2015-10-01

Details

Check Text ( C-28632r1_chk )
Check the group ownership of the traceroute file.

Procedure:
# ls -lL /usr/sbin/traceroute

If the traceroute command is not group-owned by root, sys, or bin, this is a finding.
Fix Text (F-25667r1_fix)
Change the group-owner of the traceroute command to root.

Procedure:
# chgrp root /usr/sbin/traceroute