From owner-freebsd-bugs  Mon Jul 16 10:40: 9 2001
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id CC15E37B408
	for <freebsd-bugs@hub.freebsd.org>; Mon, 16 Jul 2001 10:40:00 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.4/8.11.4) id f6GHe0Y28220;
	Mon, 16 Jul 2001 10:40:00 -0700 (PDT)
	(envelope-from gnats)
Received: from fasterix.frmug.org (d211.dhcp212-198-74.noos.fr [212.198.74.211])
	by hub.freebsd.org (Postfix) with ESMTP id 6B77E37B407
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 16 Jul 2001 10:33:05 -0700 (PDT)
	(envelope-from pb@fasterix.frmug.org)
Received: (from pb@localhost)
	by fasterix.frmug.org (8.11.3/8.9.3/pb-19990315) id f6GHX1Z17088;
	Mon, 16 Jul 2001 19:33:01 +0200 (CEST)
Message-Id: <200107161733.f6GHX1Z17088@fasterix.frmug.org>
Date: Mon, 16 Jul 2001 19:33:01 +0200 (CEST)
From: Pierre Beyssac <pb@fasterix.freenix.org>
Reply-To: pb@fasterix.freenix.org
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.113
Subject: bin/29026: traceroute -s option allows IP spoofing for non-root
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         29026
>Category:       bin
>Synopsis:       traceroute -s option allows any IP address
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jul 16 10:40:00 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     Pierre Beyssac
>Release:        FreeBSD 2, 3, 4, 5
>Organization:
individual
>Environment:

traceroute -s option doesn't check that the provided source address
exists on the host, even when not running as root.

I believe this used to be checked by the bind() call below, but
this code is not activated anymore and has not been for a long
time, and even reactivating it doesn't seem to fix the problem.

This has been broken since FreeBSD 2.2.6 at least (oldest release
I have access to).

I'll be working on a fix unless someone beats me to it.

#ifndef IP_HDRINCL
                if (bind(sndsock, (struct sockaddr *)&from, sizeof(from)) < 0) {
                        Fprintf(stderr, "%s: bind: %s\n",
                            prog, strerror(errno));
                        exit (1);
                }
#endif

Pierre
>Description:
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message