UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must ignore IPv4 ICMP redirect messages.


Overview

Finding ID Version Rule ID IA Controls Severity
V-67729 AOSX-11-001200 SV-82219r1_rule Medium
Description
ICMP redirects are broadcast in order to reshape network traffic. A malicious user could craft fake redirect packets and try to force all network traffic to pass through a network sniffer. If the system is not configured to ignore these packets, it could be susceptible to this kind of attack.
STIG Date
Apple OS X 10.11 Security Technical Implementation Guide 2017-01-05

Details

Check Text ( C-68295r1_chk )
To check if the system is configured to ignore "ICMP redirect" messages, run the following command:

sysctl net.inet.icmp.drop_redirect

If the value is not "1", this is a finding.
Fix Text (F-73843r1_fix)
To configure the system to ignore "ICMP redirect" messages, add the following line to "/etc/sysctl.conf", creating the file if necessary:

net.inet.icmp.drop_redirect=1