Outbound ICMP Time Exceed messages must be blocked to prevent network discovery by unauthorized users.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3028	NET0918	SV-15377r4_rule		Low

Description
The trace route tool will display routes and trip times on an IP network. An attacker can use trace route responses to create a map of the subnets and hosts behind the perimeter router, just as they could do with pings. The traditional trace route relies on TTL - time exceeded responses from routers along the path and an ICMP port-unreachable message from the target host. In some Operating Systems such as UNIX, trace route will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block trace route capabilities along with blocking potentially legitimate traffic on a network, it's unnecessary to block them explicitly. Because trace routes typically rely on ICMP Type 11 - Time exceeded message, the time exceeded message will be the target for implicitly or explicitly blocking outbound from the trusted network.

Description

The trace route tool will display routes and trip times on an IP network. An attacker can use trace route responses to create a map of the subnets and hosts behind the perimeter router, just as they could do with pings. The traditional trace route relies on TTL - time exceeded responses from routers along the path and an ICMP port-unreachable message from the target host. In some Operating Systems such as UNIX, trace route will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block trace route capabilities along with blocking potentially legitimate traffic on a network, it's unnecessary to block them explicitly. Because trace routes typically rely on ICMP Type 11 - Time exceeded message, the time exceeded message will be the target for implicitly or explicitly blocking outbound from the trusted network.

STIG	Date
Perimeter Router Security Technical Implementation Guide Juniper	2016-12-23

Details

Check Text ( C-12843r4_chk )
Review the device configuration to determine if ACLs block ICMP Type 11 - Time exceeded outbound to untrusted networks (e.g., ISP and other non-DoD networks). If ICMP Type 11 - Time Exceeded is not blocked outbound on the network device, this is a finding JUNOS Example: [edit interfaces] fe-2/0/10 { description "downstream link to our network”; unit 0 { family inet { filter { input egress-filter; } address 10.0.0.1/24; } } } [edit firewall] family inet { filter egress-filter { term icmp-out-bad { from { source-address { 10.0.0.0/24; } protocol icmp; icmp-type [ time exceeded ]; } then { syslog; discard; } } }

Check Text ( C-12843r4_chk )

Review the device configuration to determine if ACLs block ICMP Type 11 - Time exceeded outbound to untrusted networks (e.g., ISP and other non-DoD networks).

If ICMP Type 11 - Time Exceeded is not blocked outbound on the network device, this is a finding

JUNOS Example:
[edit interfaces]
fe-2/0/10 {
description "downstream link to our network”;
unit 0 {
family inet {
filter {
input egress-filter;
}
address 10.0.0.1/24;
}
}
}
[edit firewall]
family inet {
filter egress-filter {
term icmp-out-bad {
from {
source-address {
10.0.0.0/24;
}
protocol icmp;
icmp-type [ time exceeded ];
}
then {
syslog;
discard;
}
}
}

Fix Text (F-3053r8_fix)
Configure an ACL on the network device to block ICMP Type 11 - Time Exceeded outbound to untrusted networks (e.g., ISP and other non-DoD networks).