Subject: Re: [vserver] Vserver and localhost sniffing
From: Alejandro Cabrera <alejandro_facultad@yahoo.com.ar>
Date: Tue, 26 Feb 2008 04:16:41 -0800 (PST)
Tue, 26 Feb 2008 04:16:41 -0800 (PST)
I refer to vserver in general, because past year someone from vserver development area
was talking about this security issue. He said that any guest root with a cap sniffer
can sniff traffic from the host localhost where all traffic pass through.

Is this issue still true ???

Thanks a lot

----- Mensaje original ----
De: Declan Mullen <declan@jadplace.com>
Para: vserver@list.linux-vserver.org
Enviado: martes 26 de febrero de 2008, 9:43:09
Asunto: Re: [vserver] Vserver and localhost sniffing

Which 
version 
of 
vserver 
are 
you 
refering 
to 
?


Alejandro 
Cabrera 
wrote:
> 
Dear 
all, 
I 
read 
that 
if 
I 
have 
a 
vserver 
host 
with 
lo 
(127.0.0.1 
> 
<http://127.0.0.1/>) 
and 
some 
vserver 
guests 
with 
lo 
127.0.0.2 
> 
<http://127.0.0.2/>, 
127.0.0.3 
<http://127.0.0.3/>, 
etc...there 
is 
a
> 
risk 
that 
some 
guest 
root 
can 
use 
some 
type 
of 
sniffer 
(cap) 
and 
sniff 
> 
the 
traffic 
across 
127.0.0.1 
<http://127.0.0.1/> 
that 
is 
ALL 
localhost 
> 
traffic 
(including 
127.0.0.2 
<http://127.0.0.2/>, 
127.0.0.3 
> 
<http://127.0.0.3/>, 
etc.). 
This 
is 
a 
serious 
security 
problem.
>
> 
Here 
is 
my 
question: 
what 
happen 
with 
localhost 
sniffing 
if 
I 
assign 
a 
> 
private 
IP 
to 
the 
guest 
localhosts 
in 
order 
to 
replace 
127.0.0.2 
> 
<http://127.0.0.2/>,
> 
127.0.0.3 
<http://127.0.0.3/>, 
etc. 
with 
192.168.0.2 
> 
<http://192.168.0.2/>, 
192.168.0.3 
<http://192.168.0.3/>, 
etc.??? 
> 
Guest 
roots 
can 
still 
sniff 
the 
traffic 
???
>
> 
Special 
thanks
>
> 
Alejandro
>
> 
------------------------------------------------------------------------
>
> 
Yahoo! 
Encuentros
> 
Ahora 
encontrar 
pareja 
es 
mucho 
más 
fácil, 
probá 
el 
nuevo 
Yahoo! 
> 
Encuentros.
> 
Visitá 
http://yahoo.cupidovirtual.com/servlet/NewRegistration







      Tarjeta de crédito Yahoo! de Banco Supervielle.
Solicitá tu nueva Tarjeta de crédito. De tu PC directo a tu casa. www.tuprimeratarjeta.com.ar


I refer to vserver in general, because past year someone from vserver development area was talking about this security issue. He said that any guest root with a cap sniffer can sniff traffic from the host localhost where all traffic pass through.

Is this issue still true ???

Thanks a lot

----- Mensaje original ----
De: Declan Mullen <declan@jadplace.com>
Para: vserver@list.linux-vserver.org
Enviado: martes 26 de febrero de 2008, 9:43:09
Asunto: Re: [vserver] Vserver and localhost sniffing

Which version of vserver are you refering to ?


Alejandro Cabrera wrote:
> Dear all, I read that if I have a vserver host with lo (127.0.0.1
> <http://127.0.0.1/>) and some vserver guests with lo 127.0.0.2
> <http://127.0.0.2/>, 127.0.0.3 <http://127.0.0.3/>, etc...there is a
> risk that some guest root can use some type of sniffer (cap) and sniff
> the traffic across 127.0.0.1 <http://127.0.0.1/> that is ALL localhost
> traffic (including 127.0.0.2 <http://127.0.0.2/>, 127.0.0.3
> <http://127.0.0.3/>, etc.). This is a serious security problem.
>
> Here is my question: what happen with localhost sniffing if I assign a
> private IP to the guest localhosts in order to replace 127.0.0.2
> <http://127.0.0.2/>,
> 127.0.0.3 <http://127.0.0.3/>, etc. with 192.168.0.2
> <http://192.168.0.2/>, 192.168.0.3 <http://192.168.0.3/>, etc.???
> Guest roots can still sniff the traffic ???
>
> Special thanks
>
> Alejandro
>
> ------------------------------------------------------------------------
>
> Yahoo! Encuentros
> Ahora encontrar pareja es mucho más fácil, probá el nuevo Yahoo!
> Encuentros.
> Visitá http://yahoo.cupidovirtual.com/servlet/NewRegistration





Tarjeta de crédito Yahoo! de Banco Supervielle. Solicitá tu nueva Tarjeta de crédito. De tu PC directo a tu casa.
Visitá www.tuprimeratarjeta.com.ar