UCF STIG Viewer Logo

The system must not respond to ICMPv6 echo requests sent to a broadcast address.


Overview

Finding ID Version Rule ID IA Controls Severity
V-23972 GEN007950 SV-29785r1_rule ECSC-1 Medium
Description
Responding to broadcast ICMP echo requests facilitates network mapping and provides a vector for amplification attacks.
STIG Date
SOLARIS 9 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE 2015-10-01

Details

Check Text ( C-30065r1_chk )
Determine if the system is configured to ignore IPv6 multicast ICMP echo-requests.

Procedure:
# ndd -get /dev/ip ip6_respond_to_echo_multicast

If the result is not 0, this is a finding.
Fix Text (F-26896r1_fix)
Configure the system to not respond to IPv6 multicast ICMP echo-requests.

Procedure:
# ndd -set /dev/ip ip6_respond_to_echo_multicast 0

This command must also be added to a system startup script.