UCF STIG Viewer Logo

The system must not respond to Internet Control Message Protocol v4 (ICMPv4) echoes sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22410 GEN003603 SV-64459r1_rule Medium
Description
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
STIG Date
Oracle Linux 5 Security Technical Implementation Guide 2020-02-25

Details

Check Text ( C-52885r1_chk )
Verify the system does not respond to ICMP ECHO_REQUESTs set to broadcast addresses.

Procedure:
# cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

If the result is not 1, this is a finding.
Fix Text (F-55061r1_fix)
Configure the system to not respond to ICMP ECHO_REQUESTs sent to broadcast addresses. Edit /etc/sysctl.conf and add a setting for "net.ipv4.icmp_echo_ignore_broadcasts=1" and reload the sysctls.

Procedure:
# echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
# sysctl -p