Title

The traceroute command owner must be root. (Cat II impact)

Discussion

If the traceroute command owner has not been set to root, an unauthorized user could use this command to obtain knowledge of the network topology inside the firewall. This information may allow an attacker to determine trusted routers and other network information possibly leading to system and network compromise.

Check Content

# ls -lL /usr/sbin/traceroute If the traceroute command is not owned by root, this is a finding.

Fix Text

Change the owner of the traceroute command to root. Example procedure: # chown root /usr/sbin/traceroute

Additional Identifiers

Rule ID: SV-226925r603265_rule

Vulnerability ID: V-226925

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.