UCF STIG Viewer Logo

The system must not respond to ICMP timestamp requests sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22411 GEN003604 SV-26624r1_rule ECSC-1 Medium
Description
The processing of Internet Control Message Protocol (ICMP) timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.
STIG Date
SOLARIS 9 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE 2015-10-01

Details

Check Text ( C-27662r1_chk )
Verify the system does not respond to ICMP timestamp requests set to broadcast addresses.
# ndd /dev/ip ip_respond_to_echo_broadcast
If the result is not 0, this is a finding.
Fix Text (F-23867r1_fix)
Configure the system to not respond to ICMP timestamp requests sent to broadcast addresses.
# ndd -set /dev/ip ip_respond_to_echo_broadcast 0
Also add this command to a system startup script.