Wireshark-dev: [Wireshark-dev] Security Consideration: Priviledge Separation

From: "CS Lee" <geek00l@xxxxxxxxx>
Date: Thu, 12 Oct 2006 01:40:50 +0800
Gentle people,

I know lots of wireshark users always prefer to have new protocol parsers or decoders added, while everytime when new stuffs added, it will add excitement of it since it becomes more and more feature rich, however since we all know that wireshark or previously ethereal has lots of security vulnerabilities due to the submitted codes, I'm thinking should wireshark has priviledge separation capability like what other tools have done such as snort. I know some may not agree with me where they won't run wireshark in real time to log packets and all since dumpcap has been introduced for effective low memory footprint but retains some flexibilities. However I still have seen lots of people are trying to use wireshark on the fly when logging packets and doing analysis on the fly.

So since wireshark needs root priviledge for initial launch, maybe we can have wireshark drop its priviledge to other user(wireshark user maybe), I think this can incredibly enhance the security of wireshark which is always criticized by the communities.

Ober has done initial work previosly(ehtereal 0.10.14) but he seems not commited or submited his code to ethereal community but add it to his own OpenBSD unoffical port(check www.linbsd.org), maybe can borrow his privsep codes or write a better one if anyone can take it.

Just my 2 cents, I think wireshark should be very good to have this feature. Thanks.

--
Best Regards,

CS Lee<geekooL[at]gmail.com>