Detections
Analytics

1.125 SOL-11.1-050100

Information

The system must disable TCP reverse IP source routing.

GROUP ID: V-216140RULE ID: SV-216140r959010

If enabled, reverse IP source routing would allow an attacker to more easily complete a three-way TCP handshake and spoof new connections.

Solution

The Network Management profile is required.

Disable reverse source routing.

pfexec ipadm set-prop -p _rev_src_routes=0 tcp

See Also

https://workbench.cisecurity.org/benchmarks/23873

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216140r959010_rule, STIG-ID|SOL-11.1-050100, Vuln-ID|V-216140

Plugin: Unix

Control ID: 4fedf6494ea9220806f8e12b9ab796dfdc43e1f09624fccd11ed2ecbcc101878