UCF STIG Viewer Logo

The system must prevent local applications from generating source-routed packets.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22413 GEN003606 M6 SV-38202r1_rule ECSC-1 Medium
Description
Source-routed packets allow the source of the packet to suggest routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures.
STIG Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft 2013-01-10

Details

Check Text ( C-37659r1_chk )
Open a terminal session and enter the following command to view the value of "net.inet.ip.sourceroute".

sysctl -a | grep net.inet.ip.sourceroute

If the value of "net.inet.ip.sourceroute" is not set to "0", this is a finding.
Fix Text (F-32900r1_fix)
Open a terminal session and edit the /etc/sysctl.conf file and add the following line.

net.inet.ip.sourceroute=0

NOTE: If the sysctl.conf file does not exist use the following command to create one.
touch /etc/sysctl.conf