Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The macOS system must ignore IPv4 ICMP redirect messages.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-81699 | AOSX-13-001200 | SV-96413r1_rule | Medium |
| Description |
|---|
| ICMP redirects are broadcast to reshape network traffic. A malicious user could craft fake redirect packets and try to force all network traffic to pass through a network sniffer. If the system is not configured to ignore these packets, it could be susceptible to this kind of attack. |
| STIG | Date |
|---|---|
| Apple OS X 10.13 Security Technical Implementation Guide | 2019-03-08 |
Details
| Check Text ( C-81479r1_chk ) |
|---|
| To check if the system is configured to ignore "ICMP redirect" messages, run the following command: sysctl net.inet.icmp.drop_redirect If the value is not "1", this is a finding. |
| Fix Text (F-88547r1_fix) |
|---|
| To configure the system to ignore "ICMP redirect" messages, add the following line to "/etc/sysctl.conf", creating the file if necessary: net.inet.icmp.drop_redirect=1 |