Solaris 10 X86 Security Technical Implementation Guide

The Solaris 10 X86 Security Technical Implementation Guide (V2 R4) has 513 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

513STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Thu Jan 26 2023

The system must not respond to ICMP timestamp requests sent to a broadcast address.

Solaris 10 X86 Security Technical Implementation Guide

Assessment Title

Rule Text

The system must not respond to ICMP timestamp requests sent to a broadcast address.

Description

Discussion Text

The processing of Internet Control Message Protocol (ICMP) timestamp requests increases the attack surface of the system. Responding to broadcast ICMP timestamp requests facilitates network mapping and provides a vector for amplification attacks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-227797

Rule

SV-227797r603266_rule

Severity

medium

Rule Version

GEN003604

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Determine the type of zone that you are currently securing.
# zonename

If the zone is not the global zone, determine if any interfaces are exclusive to the zone:
# dladm show-link

If the output indicates "insufficient privileges" then this requirement is not applicable.

If the zone is the global zone or the non-global zone has exclusive interfaces verify the system does not respond to ICMP timestamp requests set to broadcast addresses.

# ndd /dev/ip ip_respond_to_echo_broadcast

If the result is not 0, this is a finding.

Implementation Procedure

Fix Text

Configure the system to not respond to ICMP timestamp requests sent to broadcast addresses.
# ndd -set /dev/ip ip_respond_to_echo_broadcast 0
Also add this command to a system startup script.

STIG check 320 of 513 in the Solaris 10 X86 STIG checklist

← Previous · V-227796The system must not respond to ICMPv4 echoes sent to a broadcast address.Next · V-227798 →The system must not apply reversed source routing to TCP responses.