Detections
Analytics

1.118 SOL-11.1-050030

Information

The system must not respond to ICMP broadcast timestamp requests.

GROUP ID: V-216133RULE ID: SV-216133r959010

By accurately determining the system's clock state, an attacker can more effectively attack certain time-based pseudorandom number generators (PRNGs) and the authentication systems that rely on them.

Solution

The Network Management profile is required.

Disable respond to timestamp broadcasts.

pfexec ipadm set-prop -p _respond_to_timestamp_broadcast=0 ip

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216133r959010_rule, STIG-ID|SOL-11.1-050030, Vuln-ID|V-216133

Plugin: Unix

Control ID: 96405e97d1e8e0515719b729472f2ba56636818c57bd0fb409e69e5a7dd215f0