Detections
Analytics
GEN007950 - The system must not respond to ICMPv6 echo requests sent to a broadcast address.
Information
Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.Solution
Add an iptables rule that drops inbound IPv6 ICMP ECHO_REQUESTs sent to the all-hosts multicast address.Edit /etc/sysconfig/ip6tables and add a rule in, or referenced by, the INPUT chain such as:
-A INPUT -p icmpv6 -d ff02::1 --icmpv6-type 128 -j DROP
Reload the iptables rules.
Procedure:
# service ip6tables restart
See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-23972, Rule-ID|SV-29788r1_rule, STIG-ID|GEN007950, Vuln-ID|V-23972
Plugin: Unix
Control ID: 01287dd39477f0ea4f7b9e36bbc2e00d9d71eaaa4343e7d9ab7ea0c710fa2f39