The system must provide protection from Internet Control Message Protocol (ICMP) attacks on TCP connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-29496	GEN000000-AIX0210	SV-38700r1_rule	ECSC-1	Medium

Description
The ICMP attacks may be of the form of ICMP source quench attacks and Path MTU Discovery (PMTUD) attacks. If this network option tcp_icmpsecure is turned on, the system does not react to ICMP source quench messages. This will protect against ICMP source quench attacks. The payload of the ICMP message is tested to determine if the sequence number of the TCP header portion of the payload is within the range of acceptable sequence numbers. This will mitigate PMTUD attacks to a large extent.

Description

The ICMP attacks may be of the form of ICMP source quench attacks and Path MTU Discovery (PMTUD) attacks. If this network option tcp_icmpsecure is turned on, the system does not react to ICMP source quench messages. This will protect against ICMP source quench attacks. The payload of the ICMP message is tested to determine if the sequence number of the TCP header portion of the payload is within the range of acceptable sequence numbers. This will mitigate PMTUD attacks to a large extent.

STIG	Date
AIX 5.3 Security Technical Implementation Guide	2012-05-25

Details

Check Text ( C-37796r1_chk )
Check the value of the tcp_icmpsecure parameter. # /usr/sbin/no -o tcp_icmpsecure If the value returned is not 1, this is a finding.

Fix Text (F-33054r1_fix)
Set the tcp_icmpsecure parameter to 1. # /usr/sbin/no -p -o tcp_icmpsecure=1