SV-35025r1: The system must not respond to ICMPv4 echoes sent to a broadcast address. | HP-UX 11.23 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must not respond to ICMPv4 echoes sent to a broadcast address.

Description

Discussion Text

Responding to broadcast Internet Control Message Protocol (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001551

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target HP-UX 11.23 DISA DPMS Target HP-UX 11.23 2170

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.hpux11:def:214
if [ ! -f "/etc/rc.config.d/nddconf" ]; then echo "PASS"; exit 0; fi
if grep -q "TRANSPORT_NAME\[x\]=ip" "/etc/rc.config.d/nddconf" && grep -q "NDD_NAME\[x\]=ip_respond_to_echo_broadcast" "/etc/rc.config.d/nddconf" && grep -q "NDD_VALUE\[x\]=0" "/etc/rc.config.d/nddconf"; then echo "PASS"; exit 0; fi
echo "FAIL"; exit 1

Remediation

Configure the system to not respond to ICMP ECHO_REQUESTs 
sent to broadcast addresses.

# ndd -set /dev/ip ip_respond_to_echo_broadcast 0

Edit /etc/rc.config.d/nddconf and add/set:
TRANSPORT_NAME[x]=ip
NDD_NAME[x]=ip_respond_to_echo_broadcast
NDD_VALUE[x]=0