UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Oracle Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-221877 OL07-00-040630 SV-221877r880648_rule Medium
Description
Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.
STIG Date
Oracle Linux 7 Security Technical Implementation Guide 2023-12-01

Details

Check Text ( C-23592r880646_chk )
Verify the system does not respond to IPv4 ICMP echoes sent to a broadcast address.

# grep -r net.ipv4.icmp_echo_ignore_broadcasts /run/sysctl.d/* /etc/sysctl.d/* /usr/local/lib/sysctl.d/* /usr/lib/sysctl.d/* /lib/sysctl.d/* /etc/sysctl.conf 2> /dev/null

If "net.ipv4.icmp_echo_ignore_broadcasts" is not configured in the /etc/sysctl.conf file or in any of the other sysctl.d directories, is commented out, or does not have a value of "1", this is a finding.

Check that the operating system implements the "icmp_echo_ignore_broadcasts" variable with the following command:

# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts
net.ipv4.icmp_echo_ignore_broadcasts = 1

If the returned line does not have a value of "1", this is a finding.

If conflicting results are returned, this is a finding.
Fix Text (F-23581r880647_fix)
Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value):

net.ipv4.icmp_echo_ignore_broadcasts = 1

Issue the following command to make the changes take effect:

# sysctl --system