Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The system must not send IPv4 ICMP redirects by default.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-67745 | AOSX-11-001210 | SV-82235r1_rule | Medium |
| Description |
|---|
| ICMP redirects are broadcast in order to reshape network traffic. A malicious user could use the system to send fake redirect packets and try to force all network traffic to pass through a network sniffer. Disabling ICMP redirect broadcasts mitigates this risk. |
| STIG | Date |
|---|---|
| Apple OS X 10.11 Security Technical Implementation Guide | 2017-07-11 |
Details
| Check Text ( C-68311r1_chk ) |
|---|
| To check if the system is configured to send "ICMP redirects", run the following command: sysctl net.inet.ip.redirect If the values are not set to "0", this is a finding. |
| Fix Text (F-73859r1_fix) |
|---|
| To configure the system to not send "ICMP redirects", add the following line to "/etc/sysctl.conf", creating the file if necessary: net.inet.ip.redirect=0 |