Milen Rangelov wrote: > The sing utility (Send Nasty ICMP Garbage) is a ping replacement that > allows sending ICMP packets with spoofed source and custom ICMP > types/codes (http://sourceforge.net/projects/sing). > > The debian package provides sing as a suid binary (actually, > the sid distribution asks the user whether he'd like it installed suid, > I'm not 100% sure, but in etch, it installs it suid, anyway, should > check). Thanks for bringing this to our attention. However, above statement is not correct. Both the sing packages in Debian oldstable (Sarge) and Debian stable (Etch) do not provide a setuid root binary by default. The override status is handled by debconf and defaults to no: | For 'sing' to work for non-root users, it needs to be suid. | | Please keep in mind that making 'sing' suid, allows non-root users to | send spoofed ICMP messages from your machine. | | If you don't know what that means, refuse to make it suid here, and | run 'sing' only as root. Cheers, Moritz
