The system must disable ICMP redirect messages.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48197	SOL-11.1-050090	SV-61069r1_rule		Low

Description
A malicious user can exploit the ability of the system to send ICMP redirects by continually sending packets to the system, forcing the system to respond with ICMP redirect messages, resulting in an adverse impact on the CPU performance of the system.

STIG	Date
Solaris 11 X86 Security Technical Implementation Guide	2015-04-03

Details

Check Text ( C-50629r1_chk )
Determine if ICMP redirect messages are disabled. # ipadm show-prop -p _send_redirects -co current ipv4 # ipadm show-prop -p _send_redirects -co current ipv6 If the output of all commands is not "0", this is a finding.

Fix Text (F-51805r1_fix)
The Network Management profile is required. Disable send redirects for IPv4 and IPv6. # pfexec ipadm set-prop -p _send_redirects=0 ipv4 # pfexec ipadm set-prop -p _send_redirects=0 ipv6