The traceroute command must be group-owned by sys, bin, root, or system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4370	GEN003980	SV-4370r2_rule	ECLP-1	Medium

Description
If the group owner of the traceroute command has not been set to a system group, unauthorized users could have access to the command and use it to gain information regarding a network's topology inside of the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.

STIG	Date
VMware ESX 3 Server	2016-05-13

Details

Check Text ( C-8251r2_chk )
Determine traceroute command locations and group ownership. Procedure: # find / -name traceroute -exec ls -lL {} \; If the traceroute command is not group-owned by root, sys, bin, or system, this is a finding.

Fix Text (F-4281r2_fix)
Change the group owner of the traceroute command to root, bin, sys, or system. Procedure: # chgrp root