Detections
Analytics

GEN003603 - The system must not respond to ICMPv4 echoes sent to a broadcast address.

Information

Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.

Solution

Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for 'net.ipv4.icmp_echo_ignore_broadcasts=1' and reload the sysctls.

Procedure:
# echo 'net.ipv4.icmp_echo_ignore_broadcasts=1' >> /etc/sysctl.conf
# sysctl -p

See Also

http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4, CAT|II, CCE|CCE-3644-2, CCI|CCI-001551, Group-ID|V-22410, Rule-ID|SV-37608r1_rule, STIG-ID|GEN003603, Vuln-ID|V-22410

Plugin: Unix

Control ID: 31ba6ed268ca980d4b4a04d3448f042c0658e67e4eb16790ae51dc2e6602ab44