UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The system must ignore IPv6 ICMP redirect messages.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22550 GEN007860 SV-45990r2_rule Medium
Description
ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.
STIG Date
SUSE Linux Enterprise Server v11 for System z 2016-12-20

Details

Check Text ( C-43272r2_chk )
Verify the system is configured to ignore IPv6 ICMP redirect messages.
# cat /proc/sys/net/ipv6/conf/all/accept_redirects

If the /proc/sys/net/ipv6/conf/all/accept_redirects entry does not exist because of compliance with GEN007720, this is not a finding.

If the returned value is not "0", this is a finding.
Fix Text (F-39355r1_fix)
Configure the system to ignore IPv6 ICMP redirect messages.
Edit "/etc/sysctl.conf" and add a settings for "net.ipv6.conf.default.accept_redirects=0" and "net.ipv6.conf.all.accept_redirects=0".
Restart the system for the setting to take effect.