SV-35026r1: The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address. | HP-UX 11.31 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The system must not respond to Internet Control Message Protocol (ICMP) timestamp requests sent to a broadcast address.

Description

Discussion Text

The processing of ICMP timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001551

Additional Details

Responsibility

System Administrator

IA Controls

ECSC-1

References

DPMS Target HP-UX 11.31 DISA DPMS Target HP-UX 11.31 2171

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.hpux11:def:215

if [ ! -f "/etc/rc.config.d/nddconf" ]; then
  echo "PASS"
  exit 0
fi

if grep -q "^TRANSPORT_NAME\[[0-9]+\]=ip" /etc/rc.config.d/nddconf && \
   grep -q "^NDD_NAME\[[0-9]+\]=ip_respond_to_timestamp_broadcast" /etc/rc.config.d/nddconf && \
   grep -q "^NDD_VALUE\[[0-9]+\]=0" /etc/rc.config.d/nddconf; then
  echo "PASS"
  exit 0
else
  echo "FAIL"
  exit 1
fi

Remediation

Configure the system to not respond to ICMP timestamp requests 
sent to broadcast addresses.
# ndd -set /dev/ip ip_respond_to_timestamp_broadcast 0

Edit /etc/rc.config.d/nddconf and add/set:
TRANSPORT_NAME[x]=ip
NDD_NAME[x]=ip_respond_to_timestamp_broadcast 
NDD_VALUE[x]=0