Detections
Analytics

1.120 SOL-11.1-050030

Information

The system must not respond to ICMP broadcast timestamp requests.

GROUP ID: V-216370
RULE ID: SV-216370r959010

By accurately determining the system's clock state, an attacker can more effectively attack certain time-based pseudorandom number generators (PRNGs) and the authentication systems that rely on them.

Solution

The Network Management profile is required.

Disable respond to timestamp broadcasts.

# pfexec ipadm set-prop -p _respond_to_timestamp_broadcast=0 ip

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216370r959010_rule, STIG-ID|SOL-11.1-050030, Vuln-ID|V-216370

Plugin: Unix

Control ID: 19b7743fd4ae026c5cbd4f70c09467c941b4e285d3edb76c4f1d5e38933a5462