Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-248878 | OL08-00-040230 | SV-248878r780200_rule | Medium |
Description |
---|
Responding to broadcast ICMP echoes facilitates network mapping and provides a vector for amplification attacks. There are notable differences between Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6). IPv6 does not implement the same method of broadcast as IPv4. Instead, IPv6 uses multicast addressing to the all-hosts multicast group. Refer to RFC4294 for an explanation of "IPv6 Node Requirements", which resulted in this difference between IPv4 and IPv6. |
STIG | Date |
---|---|
Oracle Linux 8 Security Technical Implementation Guide | 2021-07-21 |
Check Text ( C-52312r780198_chk ) |
---|
Verify OL 8 does not respond to ICMP echoes sent to a broadcast address. Note: If IPv4 is disabled on the system, this requirement is not applicable. Check the value of the "icmp_echo_ignore_broadcasts" variable with the following command: $ sudo sysctl net.ipv4.icmp_echo_ignore_broadcasts net.ipv4.icmp_echo_ignore_broadcasts = 1 If the returned line does not have a value of "1", a line is not returned, or the retuned line is commented out, this is a finding. |
Fix Text (F-52266r780199_fix) |
---|
Configure OL 8 to not respond to IPv4 ICMP echoes sent to a broadcast address with the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 If "1" is not the system's default value, add or update the following line in "/etc/sysctl.conf" or in the appropriate file under "/etc/sysctl.d": net.ipv4.icmp_echo_ignore_broadcasts=1 |