Detections
Analytics
GEN003604 - The system must not respond to ICMP timestamp requests sent to a broadcast address.
Information
The processing of (ICMP) timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.Solution
Configure the system to not respond to ICMP TIMESTAMP_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for 'net.ipv4.icmp_echo_ignore_broadcasts=1' and reload the sysctls.Procedure:
# echo 'net.ipv4.icmp_echo_ignore_broadcasts=1' >> /etc/sysctl.conf
# sysctl -p
See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-4, CAT|II, CCI|CCI-001551, Group-ID|V-22411, Rule-ID|SV-29288r1_rule, STIG-ID|GEN003604, Vuln-ID|V-22411
Plugin: Unix
Control ID: d8fd4ad1df3bf45c317ab69ad403e2048285b662318f40dccb10cf6548909cc6