Detections
Analytics
5.050 - IPv6 must be disabled until a deliberate transition strategy has been implemented.
Information
Any nodes' interface with IPv6 enabled by default presents a potential risk of traffic being transmitted or received without proper risk mitigation strategy and is therefore, a serious security concern.Solution
Add the following registry values to the system.To disable IPv6 on all interfaces-
Registry Hive- HKEY_LOCAL_MACHINE
Registry Path- \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\
Value Name- DisabledComponents
Type- REG_DWORD
Value- 0xff or 0xffffffff
To disable all IPv6 tunneling interfaces-
Registry Hive- HKEY_LOCAL_MACHINE
Registry Path- \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\
Value Name- DisabledComponents
Type- REG_DWORD
Value- 0x1
Microsoft updated article 929852 with regard to disabling all IPv6 components, changing the value to 0xff. A value of 0xffffffff results in a 5-second delay in system startup. However, either value can be used to disable all IPv6 components.
See Also
http://iasecontent.disa.mil/stigs/zip/Oct2016/U_Windows_Vista_V6R41_STIG.zip
Item Details
Audit Name: DISA Windows Vista STIG v6r41
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-14873r3_rule, STIG-ID|5.050, Vuln-ID|V-14262
Plugin: Windows
Control ID: e7ddb9c0cbff711b5d759bea1d80ad546c908f42c1a211d94ed1cd5d8bd97bcb